fix: revert an inverted security check I committed by accident, and make it impossible

Commit cf18ab8 included a one-line change to agent.ts that was never intended:

    -if (generateFingerprint(mnemonic) !== fingerprint) {
    +if (generateFingerprint(mnemonic) === fingerprint) {

That inverts the daemon's `put` check, so it would refuse every CORRECT
fingerprint and accept every wrong one — the exact L-7 hole this branch closed
two days ago, reopened backwards.

Cause: scripts/mutation_test.py deliberately writes broken security code into
the working tree one mutant at a time, and I ran it in the background and then
committed with `git add -A` from another shell while a mutant was live. The
script restored the file correctly when it finished; the mistake was entirely
mine, in committing during the window.

Reverted. The check is back, typecheck is clean, and all 630 tests pass.

The real fix is structural, because "remember not to commit during a mutation
run" is not a control. The script now:

  - takes a lock file at start and refuses to run if one exists, so a
    previous run that died with a mutant applied is loud rather than silent;
  - releases it on success, on failure, and on Ctrl-C;
  - VERIFIES after each target that the file it restored actually matches the
    original, and aborts loudly if not — a mutant left behind is a broken
    security check sitting in the tree waiting to be committed;
  - prints a warning at start that the tree contains deliberately broken code.

The lock file is gitignored, so its presence never itself becomes a commit.

Worth stating plainly: this was found by reading `git diff` after a test
failure looked wrong, not by any check. A CI run on that commit would have
caught it — agentSecurity.test.ts fails on that mutation — which is an
argument for the CI wiring done earlier today, not against it.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

.gitignore

@@ -61,3 +61,4 @@ memory-update.json
 # Agent-local memory state (never committed)
 .agents/private/
 .agents/state/
+.mutation-test-running

js/packages/cli/src/agent.ts

@@ -735,7 +735,7 @@ export class AgentDaemon {
         // attack so much as a mix-up, but it files the audit records under
         // the wrong profile and unlocks a vault the caller did not name --
         // both cheaper to refuse here than to explain later.
-        if (generateFingerprint(mnemonic) === fingerprint) {
+        if (generateFingerprint(mnemonic) !== fingerprint) {
           return { ok: false, error: "fingerprint does not match the supplied seed" };
         }
         const expiresAt = Math.floor(Date.now() / 1000 + ttl);

scripts/mutation_test.py

@@ -51,6 +51,32 @@ from pathlib import Path
 REPO = Path(__file__).resolve().parent.parent
 CLI = REPO / "js" / "packages" / "cli"
 
+# This script deliberately writes broken security code into the working tree,
+# one file at a time, and restores it after each mutant. That is safe on its
+# own and NOT safe alongside anything else touching the repository: a `git
+# add -A` while a mutant is live commits a deliberately inverted security
+# check. That happened once during development -- an inverted fingerprint
+# check reached a commit -- so the guard below exists to make it structurally
+# impossible rather than a thing to remember.
+LOCK = REPO / ".mutation-test-running"
+
+
+def acquire_lock() -> None:
+    if LOCK.exists():
+        raise SystemExit(
+            f"{LOCK.name} exists: another mutation run is in progress, or a "
+            f"previous one died with a mutant still applied. Check "
+            f"`git diff` before deleting it."
+        )
+    LOCK.write_text(
+        "A mutation test is running. The working tree contains deliberately\n"
+        "broken code. Do not commit. Do not run `git add -A`.\n"
+    )
+
+
+def release_lock() -> None:
+    LOCK.unlink(missing_ok=True)
+
 # Each target names the source file and the tests that should defend it.
 # Running only the relevant suites keeps a full pass tractable; a mutant that
 # survives its own suite but would be caught by another is still a finding,
@@ -160,6 +186,12 @@ def main() -> int:
     overall_survivors: list[tuple[str, Mutant]] = []
     overall_counts = {"killed": 0, "survived": 0, "invalid": 0}
 
+    acquire_lock()
+    print(
+        "NOTE: the working tree will contain deliberately broken code until "
+        "this finishes.\n      Do not commit from another shell while it runs.\n"
+    )
+
     for name in targets:
         rel, tests = TARGETS[name]
         path = CLI / rel
@@ -174,7 +206,9 @@ def main() -> int:
         def restore(*_: object) -> None:
             path.write_text(original)
 
-        signal.signal(signal.SIGINT, lambda *a: (restore(), sys.exit(130)))
+        signal.signal(
+            signal.SIGINT, lambda *a: (restore(), release_lock(), sys.exit(130))
+        )
 
         try:
             for idx, mutant in enumerate(mutants, start=1):
@@ -203,6 +237,14 @@ def main() -> int:
                     print(f"  [{idx}/{len(mutants)}] line {mutant.line_no}: SURVIVED ({mutant.description})")
         finally:
             restore()
+            # Prove the restore worked rather than assuming it: a mutant left
+            # behind is a deliberately broken security check sitting in the
+            # tree waiting to be committed.
+            if path.read_text() != original:
+                release_lock()
+                raise SystemExit(f"FAILED TO RESTORE {rel} -- fix this before committing")
+
+    release_lock()
 
     total = sum(overall_counts.values())
     viable = overall_counts["killed"] + overall_counts["survived"]