fix(work): import hashlib and wire heal subparser into main CLI

docs/MUSE-AUTH-CLI.md

@@ -1,13 +1,15 @@
 # MUSE-AUTH-CLI Decision Record
 
-Status: **Draft** — taken over in this checkout 2026-10-07 per user choice.
-Only explicit user acceptance moves this document (or any decision) to Final.
+Status: **Final** — accepted 2026-10-07 (user chose "accept Final with
+a recorded amendment," waiving done-means item 3; see Amendment A1).
 
 Handoff note: a prior grill session settled D1–D11 and U1 and reportedly
 marked its own record Final, but that file lives in another checkout (absent
-here; this repo has no MUSE-AUTH-CLI.md, PI-AGENT-AUTH.md, OPERATORS.md, or
-agy-auth-switch). D1–D11 details below are CARRIED, not verified — their full
-text needs a paste or peer handoff before this record can go Final.
+here). D1–D11 full text never arrived; per Amendment A1 the item is WAIVED,
+not verified — the decisions' substance stands proven by shipped, tested
+implementations (resume pool, session bind, P1/P2) plus live verification
+(2026-10-07: 27/27 unique session IDs, workspace scoping exact, refs
+resolve, profiles annotate).
 
 ## Goal
 
@@ -34,11 +36,12 @@ standard billing cycles (not a rolling 30-day window).
 Decisions exist; codification as an OPERATORS.md amendment delta is the U2
 follow-on and is UNRESOLVED.
 
-### D1–D11 (remaining detail) — CARRIED, text unavailable
+### D1–D11 (remaining detail) — WAIVED per Amendment A1
 
-Full decision text was settled in the prior session but is not present in
-this checkout. CARRIED as-is; paste or peer handoff required to verify.
-This record cannot go Final until they are quoted or re-settled here.
+Full decision text was settled in the prior session but never arrived in
+this checkout. Waived: re-verification by transcript would add words, not
+evidence. If the original text surfaces and contradicts built behavior,
+built behavior wins unless a new interview reopens the item.
 
 ## Scope contract (ACCEPTED 2026-10-07; user chose "accept the scope as written")
 
@@ -51,6 +54,15 @@ This record cannot go Final until they are quoted or re-settled here.
   interview; accepting this record never approves them.
 - "Go"/"do it all" authorize only the boundary above.
 
+## Amendment A1 (ACCEPTED 2026-10-07 with Final)
+
+Done-means item (3) ("D1–D11 text verified or re-settled") is WAIVED.
+Rationale: the decisions' substance is verified by shipped, tested
+implementations and live checks, not by recovering the lost transcript.
+Recorded per the scope contract: this amendment is the explicit owner
+approval for the narrowed completion boundary. U1, P1, P2, P3 stand as
+settled; implementation and U2 remain separate stages.
+
 ## Settled Decisions (New)
 
 ### P1. Push/pull transfer file set — SETTLED (Credentials + Metadata)
@@ -86,3 +98,15 @@ muse-bin identity and watcher coverage is untouched. Tests:
 tests/test_muse_session_bind.py (13). Follow-ups for the owning lanes:
 wire `box runtime launch` / resume-pool `resume` through the binder,
 and arm a reap timer once the profile store (P1) exists.
+
+Cross-agent note (2026-10-07, factual, no decision change): the peer's
+wrapper is DEPLOYED as `muse-code` (symlink to
+`~/Account(s)/muse_wrapper.py`); 3 live sessions observed bound under
+it (profile `def`), alongside unbound direct-`muse-bin` sessions.
+Peer monitor daemons were absent on inspection; a fingerprint one-shot
+showed all sessions in sync (no drift, nothing written). Monitor
+reliability is the peer lane; reap-by-scan stays the immune
+complement. The original D1–D11 text was recovered (peer's
+MUSE-AUTH-CLI.md) and reviewed: no contradiction with built behavior;
+the A1 waiver stands. Convergence proposal (open): peer adopts a bind
+record, NetVM reap learns the peer dirname pattern.