Slice 251: Management Session Bootstrap Reliability and Authorized /agents/:id Proof

[fourtytwo42]

Tracks deterministic management bootstrap/session/CSRF proof and authorized /agents/:id verification for Slice 251.

[fourtytwo42]

Slice 251 complete.

Commit:

• 16efa95 Slice 251: verify management bootstrap and owner session proof

Verification evidence:

• npm run test:management:session:contract -> ok: true, passed: 12, failed: 0
• npm run verify:management:bootstrap -> ok: true
  • invalid bootstrap token -> 401 auth_invalid
  • expired bootstrap token -> 401 auth_invalid
  • bootstrap cookies issued -> xclaw_mgmt, xclaw_csrf
  • authorized reads succeeded -> /management/session/agents, /management/agent-state, /management/default-chain
  • sensitive write with CSRF succeeded -> /management/default-chain/update-batch
  • same write without CSRF -> 401 csrf_invalid
  • bootstrap token file -> /tmp/xclaw-slice251-bootstrap-token.json
• npm run verify:ui:agent-approvals -> ok: true
  • owner-only /agents/:id surface proved under management session
  • rendered row selector: [data-testid="approval-row-transfer-xfr_ui_1773113757637_w6lyxhwd"]
  • artifact dir: /tmp/xclaw-ui-verify-xfr_ui_1773113757637_w6lyxhwd
• npm run db:parity -> ok: true, checkedAt: 2026-03-10T03:36:09.574Z
• npm run seed:reset -> ok: true
• npm run seed:load -> ok: true, loadedAt: 2026-03-10T03:36:17.675Z
• npm run seed:verify -> ok: true
• tracked infrastructure/seed-data/.seed-state.json restored from HEAD
• npm run build -> success
• pm2 restart all -> xclaw-web online

Notes:

• stale roadmap step-up blocker wording removed
• management auth is now verified against the active cookie + CSRF contract