Manage Voice credentials and rotate the local bridge key atomically

[vibeforge1111]

Manage Voice credentials and rotate the local bridge key atomically

What this changes

• Migrates the dedicated OpenAI Voice credential into voice.openai.api_key and injects the selected Voice provider only across the authorized Telegram → Builder → canonical Voice owner boundary.
• Adds managed local secret spark.bridge_api_key plus a non-argv --generate rotation path.
• Removes bridge material from Spark-generated env files and injects it only into Spawner and Telegram child processes.
• Serializes staging, process snapshot, stop, backend promotion, legacy scrub, pending cleanup, restart, and rollback under one rotation lock.
• Preserves the exact pre-rotation consumer set, blocks mixed key generations, physically purges superseded backend copies, and restores the original backend on rollback.
• Makes normal stop/start lifecycle operations share the rotation authority so stop intent cannot be lost during the empty-registry window.
• Rejects key reuse against managed secrets, named Telegram profiles, provider/password/credential/authorization variables, and manifest-declared nonstandard secret bindings.
• Keeps hosted Railway/container environments platform-authoritative and avoids persisting hosted bridge material locally.
• Keeps bridge rotation success output fully constant so no secret-derived value or backend-return data reaches the logging sink.
• Advances the R30 registry and merged-source truth to the exact immutable merge identities for Voice, Builder, Spawner, and Telegram.

Exact integration identity

• Base: a53e376e11481f33e4fbddb441b5c6a15ea84196
• Candidate: 20eca9584d04bf4a7e866774c13ff3264a5de107
• Commits: 12
• Scope: 11 files, +1,900 / -162; most growth is isolated runtime authority and focused regression coverage rather than the CLI god file.
• Public attribution: the ten rewritten implementation commits retain GitHub noreply author/committer metadata plus parseable Agent-Id and Original-Commit trailers; both registry follow-up commits use GitHub noreply metadata and a parseable Agent-Id.

Proof

• Focused CLI/bridge/runtime suite: 927 passed, 2 skipped, 419 subtests.
• Hermetic full CLI suite: 1,502 passed, 2 skipped, 1,163 subtests.
• R30 merged-source truth tests: 3 passed.
• Registry pin verification: passed with 0 unverified; all four new owner tags peel to their exact merge commits.
• R-21 line-count gate: passed; cli.py remains at or below its 21,629-line baseline and tests/test_cli.py remains below baseline.
• Release-policy binding and gate/evidence separation: passed.
• New-file Ruff checks: passed.
• Direct dependency audit: no known vulnerabilities.
• Diff whitespace, Git object integrity, backend-switch, interruption, collision, stop-intent, rollback-containment, and privacy checks: passed.
• Fresh installable-artifact proof: the exact candidate was archived, installed through scripts/install.sh into a disposable isolated prefix, executed successfully, and verified all registry pins with 0 unverified.
• Exact-head GitHub checks passed: test-and-audit, secret-scan, Python 3.11/3.12/3.13 browser-use compatibility, CodeQL, and Scorecard.
• Independent final implementation review: clean.
• The initial non-hermetic full run reproduced two live-Spark-home contamination failures; the exact tests and entire suite passed under an isolated SPARK_HOME, which is the intended test boundary.

Owner and supervised integration proof

• Voice fix: spark list --json crashes with unrecognized argument #267 merged as e94f3cd588c5051b77baead8378f32154b38a0d7 and is sealed by spark-r30-2026-08-08-voice-credential-boundary.
• Builder Fix potential crashes and unhandled exceptions in cli config/validation helpers (Batch v3-61) #1009 merged as 19afe6cfdd985ff0ce7a20cd25f0712dc00f9121 and is sealed by spark-r30-2026-08-08-builder-voice-credential-boundary.
• Spawner fix(cli): preserve git clone/rev-parse stderr on cp1252 Windows consoles in clone_module_source #892 merged as b90b29734aaae5e28f2bce5a065ac15a0c4efe1f and is sealed by spark-r30-2026-08-08-spawner-fast-terminal-relay.
• Telegram [spark-compete] fix: add timeout to lsof/netstat subprocess calls in listening_pid #865, including the prior terminal-relay and loaded-runtime fixes, merged as fe8a2b322185e025c564adee7f92697fd5a07648 and is sealed by spark-r30-2026-08-08-telegram-voice-terminal-reliability.
• Every owner lane has green exact-head and post-merge CI. Installed Telegram and Spawner match their exact merge trees with sync/health green.
• Spark Recursive ran at Access level 5 with exactly one primary poller. The supervised fast-terminal mission delivered one natural terminal handoff with one request/trace join and no duplicate, unknown_mission, stale acknowledgement, or post-terminal nonterminal relay.
• Supervised /voice self-test and /voice doctor reached the canonical Voice owner. With no managed hosted Voice credential configured, the diagnostic truthfully kept hosted listening and speaking unavailable.

The operator explicitly accepted proceeding without credential rotation. This PR makes no rotation-remediation or hosted-provider-success claim, and never places credential values in generated config, the PR, or logs.

Rollback

Revert the twelve commits. The source patch performs no automatic rotation during install. A runtime rotation failure restores the prior backend and consumer set when it can prove that state; otherwise it leaves consumers stopped or reports state uncertainty instead of claiming success. Registry rollback returns Voice, Builder, Spawner, and Telegram to their prior exact commits and refs; no database or points state changes.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.