Module auth_verify 

Auth-preflight seam (docs/scoping/claude-cli-min-env.md; mission m-165b6f).

docs/scoping/claude-cli-min-env.md claims Keychain auth is HOME-independent; mission m-66aff8 contradicted that claim in practice (workers died at turn 1 with “Not logged in”, $0 cost, zero tool-use, producing empty diffs while the mission falsely completed). Rather than trust the heuristic again, verify_worker_auth drives a real trivial session under a candidate env and classifies what actually happened.

Not wired into the spawn path yet — that is a later feature. This module is a pure seam over AgentBackend so it is exercised entirely offline via crate::backend_mock::MockBackend.

Enums

AuthVerdict

Outcome of driving a trivial session under a candidate worker env.

Functions

verify_worker_auth

Drive a trivial session under candidate_env via backend and classify whether the worker’s claude CLI can authenticate under it. Never panics; any spawn/IO error or ambiguous outcome yields AuthVerdict::Inconclusive rather than a guess in either direction.