test: prove named provider routing at HTTP boundary (COD-460)

[shivros]

Summary

• add deterministic same-type named-instance fixtures to the server test support
• exercise /providers, /threads, /contacts, and explicit send_message.provider through the real HTTP router
• prove generated MCP routing reaches only the named configured instance and rejects unknown IDs
• add an end-to-end generated CLI proof: discover an instance with iris providers, pass the returned ID unchanged to iris send-message, and verify instance-scoped audit attribution

Verification

• cargo build --all-targets
• cargo test --all-targets
• cargo clippy --all-targets -- -D warnings
• cargo fmt --all -- --check
• cargo run -p iris-codegen --bin iris-codegen -- check
• git diff --check

No production configuration, credentials, deployment, or generated public contract changed.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

APPROVE. No substantive bugs found. The router-level coverage verifies distinct same-type instance IDs/types, instance attribution for threads and contacts, explicit email.ops dispatch, and no dispatch on an unknown ID. Default fake-provider construction remains compatible.

Reviewer B — Gemini 3 Flash

APPROVE. The focused HTTP test exercises the real router and verifies /providers, /threads, /contacts, explicit named routing, and structured unknown-instance rejection. No correctness or goal-alignment issue found.

[shivros]

🤖 Automated Review Panel

Reviewer A — GPT-5.6-terra

BLOCK → resolved. The initial review correctly noted that the test hard-coded mock.ops after discovery. The test now parses mock.ops from the public iris providers output and passes that exact returned value unchanged to the generated send-message command. The full required gate suite was rerun after the correction.

Reviewer B — Gemini 3 Flash

APPROVE. The compiled CLI integration test verifies named-instance discovery, explicit routing, unknown-instance rejection, and persisted instance-scoped audit attribution. No goal-alignment or correctness issue found.

[shivros]

Auto-Merge Gate — approval rationale

Confidence: 0.93

COD-460 is a focused verification-only slice. The diff adds deterministic same-type configured-instance fixtures and public HTTP, generated MCP, and compiled CLI boundary tests; it preserves the configuration and schema contracts. The CLI test discovers mock.ops from public output and reuses that ID for explicit routing, while HTTP/MCP coverage verifies instance attribution, unknown-ID rejection, and no cross-instance dispatch.

Checks observed: CI Test, Format Check, Clippy, Secret Scan, Dependency Audit, and Creed context drift all succeeded.

Independent gate verification: the compiled CLI integration test passed. The subsequent local MCP/server test build stopped only because the disposable clone exhausted disk space (No space left on device); GitHub's complete CI suite is green.

Scope limits: no credentials, deployment/cutover, billing, destructive behavior, or public contract change. Linear COD-460 and its comments contain no manual-review or do-not-auto-merge marker.