159/S3 — Connections routes: Company Compute connect path (probe-first, one round trip)

[kateebonner]

Important

Problem

No routes exist for credential entry/status; the Company Compute connect path (validate → save → status, one round trip) has no server surface.

Approach

A connections module in the fork server registered beside the existing amicode route block: submit-credential (POST body; Company Compute card first) runs the probe classification and writes through the #162 seam, returning terminal status in the same round trip; status (GET) renders through a redacting whitelist parser with a validating overlay; disconnect and revalidate round out the lifecycle; mutation routes refuse to serve on non-loopback binds. Auth enforced per #163. Demoable via curl under standalone serve. Code lands in the vendored fork (opencode repo).

---

Acceptance Criteria

1. A valid key POSTed → credential written via the seam + connected returned in the same round trip (stubbed solve service).
2. Probe classification honored: authorizer-rejection class → invalid, nothing written; server-error/network class → unreachable, nothing written; auth-passed classes → valid (the parent's probe contract).
3. The status route can never emit secret material: a poison test seeds a token into every status input and asserts absence from the response.
4. Disconnect clears the credential and status becomes needs-key; revalidate refreshes the validation timestamp without the secret riding the request.
5. When the server is bound beyond loopback, mutation routes refuse with a distinct error (simulated bind config).
6. The full lifecycle passes under standalone serve — route-level tests with no extension host involved.

Testing Decisions

Fork server route tests in the existing httpapi test idiom; a local stub stands in for the solve service; reuses #162's store test doubles — extends #162's test surface for write-path assertions.

Key Decisions

• Probe target is the fake-task status route (parent contract: authorizer rejects bad keys before the handler; good keys reach the handler's not-found/forbidden).
• Secrets ride POST bodies only — never query params, never URLs.
• Status lifecycle states per the parent's data contract (including validating in-flight).

Source

Part of #159 · ADR 0002 (PR #158) · Blocked by: #162, #163 · Lands in: opencode fork

[kateebonner]

Merged into the fork-side #159 integration branch (opencode#33); 51/51 across connections/credentials suites, full run baseline-clean. Routes live: GET /amicode/connections · POST …/credential (terminal status in one round trip) · …/disconnect · …/revalidate — auth-wrapped like sibling routes, loopback-guarded, redacting whitelist on every status read+write. Status cache: $AMICODE_CONNECTIONS_FILE → ~/.amico/connections.json. Extension points for the Pasqal card + flip documented in the module.