Review round 2: LLP 0251 never existed, and section 5 promised status fields hyp status drops

- The rollout is LLP 0242-0244 (04330ab, #794), on master; LLP 0251 is an
  unmerged number on a sibling branch, so three references dangled.
- Section 5 listed proxy_mode, expiry, cert path and permitted/intercepted
  hosts as hyp status output; ProxyTrustReport carries three fields and
  hyp status --json drops the source details block those live in.
- Section 3's / anchor rationale was inverted: the fail-closed guard is what
  stops record-everything, and the source.js merge is what stops the default
  install recording nothing.
- 0231's forward-ref uses the corpus's Designed-by name.
- Acceptance: purge deletes the CA while the running daemon keeps its own, so
  a purge-then-attach silently downgrades to base URL; the step-7 restore
  raced the CA mint the same way. Config backed up and restored, anchors
  folded into their links (#proxy-attach-preflight is LLP 0232's, not 0245's).

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: neutral

docs/ACCEPTANCE.md

@@ -541,8 +541,8 @@ about base-URL attach, which is the default and is already exercised by
 **Requires:**
 
 - A real Mac (the keychain trust dialog and `launchctl` env delivery are
-  Darwin-only; see [LLP 0237](../llp/0237-attach-trusts-ca-in-login-keychain.decision.md)
-  #darwin-only). Do not attempt this on Linux; the design states Remote
+  Darwin-only; see [LLP 0237 #darwin-only](../llp/0237-attach-trusts-ca-in-login-keychain.decision.md#darwin-only)).
+  Do not attempt this on Linux; the design states Remote
   Control inbound is unsupported there under proxy mode and there is no
   dialog or launchd table to check.
 - Claude Code installed and signed in, with Remote Control reachable from a
@@ -551,9 +551,14 @@ about base-URL attach, which is the default and is already exercised by
 - HypAware installed from the package under test, with no prior HypAware CA
   trusted in the login keychain (a machine that has run this procedure
   before will not see the dialog again in step 2; that is expected, not a
-  failure, per [LLP 0238](../llp/0238-long-lived-ca-full-provider-constraints.decision.md)
-  #ca-survives-detach. Run `hyp detach claude --purge` first if you need a
-  clean first-trust observation).
+  failure, per
+  [LLP 0238 #ca-survives-detach](../llp/0238-long-lived-ca-full-provider-constraints.decision.md#ca-survives-detach)).
+  If you need a clean first-trust observation, run `hyp detach claude --purge`
+  **and then `hyp daemon restart`**, and confirm
+  `~/.hyp/hypaware/tls/ca-cert.pem` is back before you start: purge deletes
+  the CA, the running daemon holds its own copy in memory and never re-mints,
+  and step 2 reads that file to decide which mode to attach in. Attaching
+  against the gap silently produces a base-URL attach.
 
 **Related:** [LLP 0231](../llp/0231-proxy-mode-capture.rfc.md) (the request),
 [LLP 0245](../llp/0245-proxy-mode-capture.design.md) (the design this
@@ -571,25 +576,34 @@ procedure gates, sections 1, 4 and 6),
    run never touches):
 
    ```sh
+   cp ~/.hyp/hypaware-config.json ~/.hyp/hypaware-config.json.pre-acceptance
    jq '.plugins |= map(if .name == "@hypaware/ai-gateway"
          then .config.proxy_mode = true else . end)' \
      ~/.hyp/hypaware-config.json > /tmp/hypaware-config.json \
      && mv /tmp/hypaware-config.json ~/.hyp/hypaware-config.json
    hyp daemon install
    hyp daemon start
+   hyp daemon restart   # reload the config edit above
    hyp status
    ls ~/.hyp/hypaware/tls/ca-cert.pem
    ```
 
+   The backup copy is how you put your machine back afterwards; nothing below
+   restores the original `proxy_mode` for you. The `restart` is not
+   redundant: a daemon that was already installed and running does not re-read
+   the config on `install`/`start`, so without it the CA check at the end of
+   this step fails for a reason that has nothing to do with the feature.
+
    Pass condition: `hyp status` shows the daemon running and, under
    `sources:`, the gateway source `[started]`, and the CA file exists. Check
    all three: the `jq` edit is a silent no-op if the config has no
    `@hypaware/ai-gateway` entry, and on a centrally managed host a local
    `proxy_mode` write loses the LLP 0031 layer merge outright. The CA is the
    only proof that proxy mode is actually being *served*, and step 2 reads
    exactly that file to decide which mode to attach in
-   ([LLP 0245#claude-attach](../llp/0245-proxy-mode-capture.design.md#claude-attach)
-   #proxy-attach-preflight). With no CA, `hyp attach claude` does not refuse,
+   ([LLP 0245 #claude-attach](../llp/0245-proxy-mode-capture.design.md#claude-attach),
+   realizing [LLP 0232 #proxy-attach-preflight](../llp/0232-claude-attaches-by-proxy.decision.md#proxy-attach-preflight)).
+   With no CA, `hyp attach claude` does not refuse,
    it quietly attaches in base-URL mode instead, and every step below would
    then be measuring the wrong feature.
 
@@ -605,8 +619,8 @@ procedure gates, sections 1, 4 and 6),
    text: it must name (or the surrounding attach output must state) all
    three hosts the CA is constrained to, `api.anthropic.com`,
    `api.openai.com`, and `chatgpt.com`, not only the one this attach is for
-   ([LLP 0238](../llp/0238-long-lived-ca-full-provider-constraints.decision.md)
-   #full-provider-constraints: one certificate, one dialog, every provider,
+   ([LLP 0238 #full-provider-constraints](../llp/0238-long-lived-ca-full-provider-constraints.decision.md#full-provider-constraints):
+   one certificate, one dialog, every provider,
    and the grant must be informed about all of them). Approve it.
 
    Confirm the settings write:
@@ -621,17 +635,17 @@ procedure gates, sections 1, 4 and 6),
    `_CLAUDE_CODE_ASSUME_FIRST_PARTY_BASE_URL` must be **absent** (or, if this
    machine previously ran base-URL attach, must have been released by the
    mode migration, not merely left stale)
-   ([LLP 0232](../llp/0232-claude-attaches-by-proxy.decision.md)
-   #mode-migration). `NODE_EXTRA_CA_CERTS` must point at
+   ([LLP 0232 #mode-migration](../llp/0232-claude-attaches-by-proxy.decision.md#mode-migration)).
+   `NODE_EXTRA_CA_CERTS` must point at
    `~/.hyp/hypaware/tls/ca-cert.pem` (or
    `$HYP_HOME/hypaware/tls/ca-cert.pem`).
 
 3. Confirm the launchd environment, respecting the terminal caveat: only
    processes launchd starts **after** the `setenv` see the variable, and a
    terminal app is single-process, so a window that predates step 2 will not
    see it even though it is genuinely set
-   ([LLP 0239](../llp/0239-node-use-system-ca-via-launchd.decision.md)
-   #terminals-predating-attach). Read attach's own final output line first:
+   ([LLP 0239 #terminals-predating-attach](../llp/0239-node-use-system-ca-via-launchd.decision.md#terminals-predating-attach)).
+   Read attach's own final output line first:
    it states this caveat explicitly. Then, in the **same terminal window**
    you ran step 2 in (do not open a new window yet):
 
@@ -704,8 +718,7 @@ procedure gates, sections 1, 4 and 6),
    `ProxyTrustReport`).
 
 6. Detach and confirm the CA and its trust survive, per
-   [LLP 0238](../llp/0238-long-lived-ca-full-provider-constraints.decision.md)
-   #ca-survives-detach:
+   [LLP 0238 #ca-survives-detach](../llp/0238-long-lived-ca-full-provider-constraints.decision.md#ca-survives-detach):
 
    ```sh
    hyp detach claude
@@ -758,9 +771,18 @@ procedure gates, sections 1, 4 and 6),
    ```sh
    hyp daemon install
    hyp daemon start
+   ls ~/.hyp/hypaware/tls/ca-cert.pem   # wait for this before attaching
    hyp attach claude
+   cp ~/.hyp/hypaware-config.json.pre-acceptance ~/.hyp/hypaware-config.json
    ```
 
+   Do not skip the `ls`. The gateway mints the CA after it boots and
+   `hyp attach claude` does not wait for it, so an attach fired immediately
+   after `start` can find no CA and silently write a base-URL attach,
+   leaving your working machine with Remote Control broken. Restore the
+   config backup last, and `hyp daemon restart` after it if you want the
+   machine back on its original mode.
+
 ### If it fails
 
 - `hyp attach claude` reports a base-URL attach, or writes
@@ -777,10 +799,16 @@ procedure gates, sections 1, 4 and 6),
 - No dialog in step 2 on a machine that has never run this procedure:
   confirm no earlier HypAware install already trusted a CA under this same
   login keychain (`security find-certificate -c "HypAware Local CA" ...`);
-  if one exists, `hyp detach claude --purge` first for a clean observation.
-  A refused or dismissed dialog is not a failure on its own: attach still
-  completes and states plainly that Remote Control inbound will not work
-  ([LLP 0237#attach-anyway-on-refusal](../llp/0237-attach-trusts-ca-in-login-keychain.decision.md#attach-anyway-on-refusal));
+  if one exists, `hyp detach claude --purge` first for a clean observation,
+  then `hyp daemon restart` and confirm `~/.hyp/hypaware/tls/ca-cert.pem` is
+  back before re-attaching. Purge deletes the CA and never touches config,
+  and the running daemon keeps serving the copy it loaded at boot rather than
+  re-minting, so a `hyp attach claude` in that window finds no CA and quietly
+  writes a base-URL attach instead of raising the dialog again. That reads
+  identically to "still no dialog", so check the CA file rather than the
+  symptom. A refused or dismissed dialog is not a failure on its own:
+  attach still completes and states plainly that Remote Control inbound will not work
+  ([LLP 0237 #attach-anyway-on-refusal](../llp/0237-attach-trusts-ca-in-login-keychain.decision.md#attach-anyway-on-refusal));
   re-running `hyp attach claude` retries the dialog.
 - Step 3's `echo $NODE_USE_SYSTEM_CA` is empty even after a full quit and
   reopen of the terminal application: confirm you quit the *application*,

llp/0231-proxy-mode-capture.rfc.md

@@ -7,7 +7,7 @@
 **Date:** 2026-08-14
 **Related:** LLP 0016, LLP 0044, LLP 0045, LLP 0049, LLP 0066, LLP 0086, LLP 0114, LLP 0116, LLP 0176, LLP 0192, LLP 0206
 **Spawns:** LLP 0232, LLP 0233, LLP 0234, LLP 0235
-**Design:** LLP 0245
+**Designed-by:** LLP 0245, proxy-mode capture technical design
 
 > Claude Code disables **Remote Control** whenever `ANTHROPIC_BASE_URL` points
 > anywhere other than `api.anthropic.com`. Attach repoints exactly that key, so

llp/0245-proxy-mode-capture.design.md

@@ -5,8 +5,8 @@
 **Systems:** Gateway, Sources, Config, Plugins, Privacy, Core, Daemon
 **Generated-by:** neutral
 **Related:** LLP 0231, LLP 0232, LLP 0233, LLP 0234, LLP 0235, LLP 0236,
-LLP 0237, LLP 0238, LLP 0239, LLP 0246, LLP 0247, LLP 0044, LLP 0045,
-LLP 0114, LLP 0192, LLP 0206
+LLP 0237, LLP 0238, LLP 0239, LLP 0242, LLP 0243, LLP 0244, LLP 0246,
+LLP 0247, LLP 0044, LLP 0045, LLP 0114, LLP 0192, LLP 0206
 
 > Technical design for the proxy-mode capture stack the accepted RFC
 > LLP 0231 asked for: Claude Code routed through the gateway with
@@ -28,7 +28,8 @@ is the implementation design that binds those decisions to the tree.
 
 The design is realized on `master` by three commits: `fa701a7e` (#782, the
 transport, aperture, CA and attach), `d0f7c4ad` (#792, the status and trust
-reporting surface), and the rollout work covered separately by LLP 0251.
+reporting surface), and `04330abb` (#794, the LLP 0242-0244 rollout that
+turns proxy mode on).
 File paths and function names below are verified against that tree; the
 tests named in section 7 exist and gate it. What this document adds to the
 corpus is the request-level design of record: the one place the whole
@@ -37,7 +38,9 @@ above.
 
 This change set deliberately excludes who *turns proxy mode on*. Fresh
 install composition and the existing-install migration are LLP 0242's
-problem and are designed in LLP 0251, which depends on this change set.
+problem, settled by LLP 0243 (the picker row composes `proxy_mode`) and
+LLP 0244 (attach offers the migration), and already landed on `master`.
+Their own design of record belongs to that change set, not this one.
 
 ## 1. Data flow, end to end {#data-flow}
 
@@ -152,10 +155,13 @@ The CA lives in core, not in the gateway plugin, because `hyp detach` and
   configures it separately (LLP 0234).
 - `shouldRecordProxyExchange(upstream, pathname)`: the recording anchor is
   `recordPrefix ?? prefix`, and an anchor of `/` or empty records nothing;
-  failing closed is the default. Note the fallback: an upstream with no
-  `record_prefix` records under its routing prefix, so section 3's
-  `source.js` merge is what keeps a routing `path_prefix` of `/` from
-  reading as record-everything. The routing matcher is deliberately not reused: the
+  failing closed is the default, so a routing prefix of `/` can never read
+  as record-everything. Note the fallback: an upstream with no
+  `record_prefix` records under its routing prefix, which is why the
+  `source.js` merge below matters. The `hyp init` preset writes
+  `path_prefix = "/"`, so without the merge the anchor was `/`, the
+  fail-closed guard suppressed every request, and the default install
+  recorded nothing at all. The routing matcher is deliberately not reused: the
   Anthropic route matcher accepts an `sk-ant-` bearer alone, which under a
   proxy is true of every request to the host and measurably reopened the
   aperture (LLP 0234 #recording-is-opt-in-per-path).
@@ -165,13 +171,15 @@ The CA lives in core, not in the gateway plugin, because `hyp detach` and
 
 `hypaware-core/plugins-workspace/ai-gateway/src/source.js` merges each
 adapter preset's declared `path_prefix` (and `provider`) onto the merged
-upstream entry as `record_prefix`, because operator routing config wins
-over presets and a routing `path_prefix` of `/` must never read as
-record-everything; without this the default install recorded nothing at
-all (LLP 0234). It also owns the status surface: `proxy_mode`,
-`ca_fingerprint`, `ca_not_after`, `ca_cert_path`, `ca_permitted_hosts`,
-intercepted hosts, and `proxy_mode_error` when CA preparation failed while
-the gateway kept reverse-proxying.
+upstream entry as `record_prefix`. Operator config still wins the *routing*
+question, but the record anchor belongs to the adapter that registered the
+preset: an operator writing `path_prefix = "/"` is saying "route everything
+on this host here", not "record everything on this host", and the
+fail-closed guard turns that into recording nothing at all on a default
+install (LLP 0234). It also owns the gateway's own status details:
+`proxy_mode`, `ca_fingerprint`, `ca_not_after`, `ca_cert_path`,
+`ca_permitted_hosts`, `intercept_hosts`, and `proxy_mode_error` when CA
+preparation failed while the gateway kept reverse-proxying.
 
 `hypaware-core/plugins-workspace/ai-gateway/src/config.js` reads the
 switch: `proxy_mode` is on only when the config field is literally `true`
@@ -252,13 +260,24 @@ delete a different install's key material.
 
 ## 5. Status surface {#status}
 
-`src/core/commands/status.js` and `src/core/daemon/types.d.ts`
-(`ProxyTrustReport`) report: gateway `proxy_mode`, CA fingerprint, expiry,
-cert path, permitted and intercepted hosts, `proxy_mode_error`, keychain
-trust state, and whether `NODE_USE_SYSTEM_CA` is live in the launchd
-environment (`launchctl getenv`). "The dialog was cancelled last month" is
-diagnosable without re-running attach (LLP 0237), and the aperture is
-readable without grepping a boot log (LLP 0233).
+Two surfaces, and they carry different things.
+
+`hyp status` reports the trust half: `src/core/commands/status.js` renders
+the `proxy trust:` block from `ProxyTrustReport`
+(`src/core/daemon/types.d.ts`), which is exactly three facts: the CA
+fingerprint, keychain trust state, and whether `NODE_USE_SYSTEM_CA` is live
+in the launchd environment (`launchctl getenv`). Trust and launchd state are
+tri-state, because "the probe could not run" is not the claim "not trusted".
+"The dialog was cancelled last month" is diagnosable without re-running
+attach (LLP 0237).
+
+The aperture half lives in the gateway source's own status details
+(section 3): `proxy_mode`, `ca_not_after`, `ca_cert_path`,
+`ca_permitted_hosts`, `intercept_hosts` and `proxy_mode_error`, readable
+without grepping a boot log (LLP 0233). Note that `hyp status --json` maps
+each source to name, plugin and state only and drops the details block, so
+those fields are read from the daemon status file
+(`hyp daemon status --json`), not from `hyp status`.
 
 ## 6. Failure modes {#failure-modes}
 

llp/0248-proxy-mode-capture.plan.md

@@ -90,13 +90,14 @@ Two, both documentation:
 ## Out of scope {#out-of-scope}
 
 Who turns proxy mode on (fresh-install composition, existing-install
-migration) is LLP 0242's problem, was designed in LLP 0251 per the design's
-section 0, and in fact already landed on `master` as #794; it belongs to
-its own change set either way. Codex stays base-URL (RFC 0231). The
+migration) is LLP 0242's problem, settled by LLP 0243 and LLP 0244 and
+already landed on `master` as #794 (`04330abb`, this branch's merge base);
+it belongs to its own change set either way. Codex stays base-URL
+(RFC 0231). The
 `upstream_proxy` field-testing question and claude-code#75050 are recorded
 open items, not tasks.
 
 ## Tasks
 
 - id: T1  branch: task/proxy-mode-capture/T1  deps: []  complexity: 3  -- Write the missing manual acceptance procedure `claude_proxy_capture` in docs/ACCEPTANCE.md, in the same shape as the existing `codex_desktop_capture` and `openclaw_capture` entries (what it proves, what it does not prove, prerequisites, exact commands, pass condition, an "If it fails" section). Opt-in/manual, needs a real Mac. It must cover, from LLP 0245 sections 1, 4 and 6: real `hyp daemon install`/start, `hyp attach claude` in proxy mode writing only HTTPS_PROXY and NODE_EXTRA_CA_CERTS into ~/.claude/settings.json, the macOS keychain trust dialog naming all INTERCEPT_PROVIDER_HOSTS, NODE_USE_SYSTEM_CA visible via `launchctl getenv` with the fully-quit-and-reopen-terminal caveat (LLP 0239), a Claude Code session producing rows in ai_gateway_messages attributable via entrypoint while Remote Control inbound still works (the RFC's whole point), `hyp status` reporting the ProxyTrustReport fields, detach restoring env keys while the CA and keychain trust survive (LLP 0238), and `hyp detach claude --purge` plus `hyp daemon uninstall` removing CA, trust and launchd residue. Also add `claude_proxy_capture` to the written-procedures list in CLAUDE.md's Smoke Test Model section (currently lists only codex_desktop_capture). Do NOT touch any code: the mechanisms are all built and green on master (see #audit). Verification is `npm test` still green and the two docs reading consistently; no new automated tests. Prose rules apply: no em dashes anywhere.
-- id: T2  branch: task/proxy-mode-capture/T2  deps: []  complexity: 1  -- Append the design-of-record forward-ref to the request: in llp/0231-proxy-mode-capture.rfc.md's metadata header add a line `**Design:** LLP 0245` directly after the `**Spawns:**` line. This is a trivial editorial forward-ref, explicitly permitted on an Accepted doc; change nothing else in the file (no body edits, no status change). Check llp/0232 through llp/0239 headers and confirm they need no equivalent edit (0232, 0233 and 0235 already carry Extended-by/Superseded-by lines; the design cites all of them from its own side, and per-decision back-refs from code already exist). Verification: `npm test` untouched and green, and a grep shows exactly one new line added under llp/.
+- id: T2  branch: task/proxy-mode-capture/T2  deps: []  complexity: 1  -- Append the design-of-record forward-ref to the request: in llp/0231-proxy-mode-capture.rfc.md's metadata header add a line `**Designed-by:** LLP 0245` directly after the `**Spawns:**` line (`Designed-by` is the corpus's existing name for this forward-ref relation; see llp/0044). This is a trivial editorial forward-ref, explicitly permitted on an Accepted doc; change nothing else in the file (no body edits, no status change). Check llp/0232 through llp/0239 headers and confirm they need no equivalent edit (0232, 0233 and 0235 already carry Extended-by/Superseded-by lines; the design cites all of them from its own side, and per-decision back-refs from code already exist). Verification: `npm test` untouched and green, and a grep shows exactly one new line added under llp/.