rdmsm4x changelog — ecs0lib authenticated HTTP client

Implemented a bounded, secret-safe authenticated HTTP client contract in an isolated ecs0lib worktree so Tyrell can later migrate its read-only fleet usage fetch without duplicating transport policy.

Scope

• Host: rdmsm4x
• Ticket: FEAT-20260902-05
• Worktree: /Users/richh/dev/_worktrees/ecs0lib-http-client-20260902
• Branch: codex/ecs0-http-client-20260902
• Base: 90c3c6ddd6377be6012617d1934a5fbce5c028aa
• Commit: 528354f297261e4b84763cef36486ac01a0be76f
• No canonical ecs0lib or Tyrell source was modified; no deployment or live network call occurred.

Files changed

• Sources/ECS0Networking/ECS0HTTPClient.swift
• Tests/ECS0LibTests/ECS0HTTPClientTests.swift
• SESSION-STATE.md
• Handoff: /Users/richh/dev/_handoff/ecs0lib-http-client-20260902.md

Verification

• swift test --filter ECS0HTTPClientTests: 12 tests, 0 failures.
• swift test --sanitize=thread: 196 XCTest + 11 Swift Testing (207 total), 0 failures, no reported race.
• swift build -c release: succeeded.
• Generic macOS scheme build: succeeded.
• Generic iOS and visionOS scheme probes reached the pre-existing macOS-only CECSNetTopBridge libproc.h dependency and failed; tvOS also reached a pre-existing LocalAuthentication dependency. These unrelated failures were preserved as separate evidence and not repaired in this bounded change.
• Source secret-fixture scan produced no match; the test fixture provided the positive control.

Commands and operations

Created and claimed the ticket, registered and synchronized a fleet check-in, created an isolated linked worktree, ran focused and full sanitized tests, built release and generic platform targets, committed explicit owned paths, and wrote a reproducible handoff. No production URL, token value, response body, credential, or provider database was recorded.

Rollback

Do not integrate or revert commit 528354f297261e4b84763cef36486ac01a0be76f. After acceptance evidence is retained, remove only /Users/richh/dev/_worktrees/ecs0lib-http-client-20260902 and branch codex/ecs0-http-client-20260902. The canonical checkout remains independently owned and unchanged by this lane.

Outstanding owner action

Tyrell's owner may later integrate the client for read-only fleet usage, supplying Tyrell-owned endpoint enrollment and credential providers. The package-wide iOS/tvOS/visionOS portability defects remain separate ecs0lib work.