[Bl0ck154]

CI compatibility fix — stacked candidate only; do not deploy

This draft builds on #61, itself based on #60 and the upstream-first OmniRoute fork. The prior broad run 40164339727 exposed a genuine regression introduced during migration: requiring management authentication for all GET /api/resilience broke existing read-only configuration clients, including standard routing and request-queue integration paths, which began receiving 401.

Changes

• Restore the preexisting read-only resilience GET projection for anonymous/non-management clients where the existing HTTP policy permits it. Do not expose the new antigravity hot/health settings to those callers: include that field only after requireManagementAuth(request,{alwaysRequireAuth:true}) accepts the caller. Management-authorized clients still read all settings.
• Keep PATCH /api/resilience management-protected and requiring the privileged admin scope for CLI access-token mutations (parent Draft: management-only hot Antigravity health, telemetry and timeout settings #57 security fix). A write token or anonymous request still cannot alter those settings.
• Strengthen the existing admin integration test to ensure anonymous GET remains HTTP 200 with normal public configuration but without an antigravity field.
• Update the pinned pure default settings snapshot to include the new opt-in antigravity section and migration constants characterization to 35 entries with the two explicit 170/194→213 rehomes (not simply weakening/removing the checks).
• Add those missing unit suites to hosted manual API Route Typecheck gate; document broad CI outcomes and remaining failures.

Remaining

• Focused GitHub Actions must pass on exact SHA 3ba30f350ff4c72f1a14ba8600fb31dd5028f8c0.
• Broad regressions (Codex/Combo, UI-kit, i18n), security advisories and off-host production build/migration rehearsal remain blockers. No production changes.

All code authored in isolated worktree, no local VPS tests or builds.

[Bl0ck154]

2026-10-25 additional broad-CI triage (SHA 9601d26e85): full preceding candidate CI run 40164339727 completed the off-host Next Build successfully; package artifact and E2E downstream still processing. The entire Vitest suite had 3643 passed / 1 failed / 1 skipped: only ApiKeyAccessEditorClient > Save sends the full PATCH body failed, because the new legitimate preferredConnections: [] property was absent from its exact expected request body. Commit 9601d26e85 explicitly adds that field to the precise equality assertion (not dropping/weakening the test), and adds the entire existing editor Vitest file to the hosted focused gate. Previous commit 3ba30f350f restored backward-compatible GET /api/resilience normal fields, still hides private antigravity controls without management credentials, and updates pure section/migration-count invariant tests to 35 mappings. Focused GitHub CI was requested for the latest SHA. Broader unrelated/legacy security + i18n + Codex/Combo/UI-kit failures remain blockers. Do not deploy or publish a release.