fix(configs): scope required overlays by provider

[andrei-hasna]

Summary

• scope independently configured required instruction sources to the selected configs tool
• retain provider-neutral sources and only the matching hasna-<tool>-global-agent-overlay
• preserve explicit caller precedence, codex-app -> codex, and existing floor/reduction guards

Regression evidence

• pre-fix: valid Claude render failed as missing 4 of 8 unrelated overlays; missing-global control reported 5 of 8
• post-fix: bun test src/live-shortfall-guard.test.ts -> 10 pass, 0 fail
• preservation suite: bun test src/configs-prelaunch.test.ts -> 56 pass, 0 fail
• full suite: 1646 pass, 1 skip, 0 fail
• typecheck, compatibility, build, contracts, conformance, PostgreSQL integration, deterministic pack, and secret scans pass

Live acceptance

Task-built Accounts launched Claude for account010 without an unrelated-overlay shortfall. Claude then returned Not logged in · Please run /login; that later profile authentication state is separate and no profile/auth changes were made.

References OPE-00216 / Todos 4e706e3c-90ea-4517-a5b4-243731af92b1.

This PR is ready for the required independent Fable review. Do not merge, publish, or install before that GO.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #151 @ 54f8faf — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Reviewed the exact candidate against freshly fetched origin/main at 194c15da8d6e94417371e713e06b3663bdf38e21.

What I read:

• git log --oneline origin/main..HEAD: one commit, 54f8faf fix(configs): scope required overlays by provider.
• Full diff and surrounding source for src/lib/configs-prelaunch.ts, src/configs-prelaunch.test.ts, and src/live-shortfall-guard.test.ts.
• Call path through configsPrelaunchOptions, runConfigsPrelaunch, the pre/post-render shortfall guard, configsSessionToolFor, and the built-in Codex/Codex App/Claude/Codewith tool definitions.
• Manual security trace: configured required-source population → exact provider-overlay source-ID match → active configs tool → filtered required set → pre-render preservation and post-render missing-source enforcement. Neutral/global sources remain required; only other providers' convention-matching overlays are excluded.

Commands and exact results:

• bun install — exit 0 — setup only; 121 packages installed.
• bun run typecheck — exit 0 — PASS; TypeScript emitted no pass/fail count.
• bun run test — exit 0 — PASS; 1646 pass, 1 skip, 0 fail across 1647 tests / 100 files.
• git diff --check origin/main...HEAD — exit 0 — PASS.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.

[andrei-hasna]

Merge gate remains open: the latest GO was produced by a gpt-5.6-sol/OpenAI reviewer session, not the required claude-fable-5 reviewer. This PR was converted to draft at head 54f8faf pending a valid exact-head Fable review and current-main revalidation. Do not merge on the existing GO.

[andrei-hasna]

[REVIEW] GO — #151 @ 46ddda4 — lens: correctness+security+gates, reviewer Aruns (1 of 1)

The original reviewed branch was one commit behind main, and GitHub correctly refused the first merge attempt. I rebased the PR branch onto current origin/main at 194c15da8d6e94417371e713e06b3663bdf38e21.

Exact-candidate evidence:

• Pre-rebase git merge-tree --write-tree origin/main 54f8faf15749e57c24d225a24c929dbd62648720 produced tree 09fc8dfbfd6cb67a21386aca30cb924e6aeef4ad.
• Rebased 46ddda42cd9498773810af01d5d11582a1eea7e6^{tree} is exactly 09fc8dfbfd6cb67a21386aca30cb924e6aeef4ad; the rebased candidate is the previously measured merge result.
• gitleaks git --redact=100 --no-banner --log-opts='origin/main..HEAD' . — exit 0; 1 commit / 4437 bytes scanned; no leaks found.
• bun run typecheck — exit 0 — PASS; TypeScript emitted no pass/fail count.
• bun run test — exit 0 — PASS; 1649 pass, 1 skip, 0 fail across 1650 tests / 100 files.
• Force-with-lease push updated only fix/ope-00216-tool-scoped-instruction-floor from 54f8faf15749e57c24d225a24c929dbd62648720 to this head.

Blocking P0/P1 findings: none.

Non-blocking follow-ups: none.