fix(provision): grant user lire (251) to ai_agent_sandbox so the armed probe passes

The checkpoint status/relink-env armed probe calls GET /users/info, which
requires Dolibarr right 251 (user->user->lire). WRITE_IDS didn't include it,
so a freshly provisioned agent answered 403 on the probe — reported NOT armed
— while its key actually authenticates (GET /thirdparties -> 200). Right 251
was granted live in SQL on the sandbox (fk_user=4) today; this persists it in
WRITE_IDS so every future provision grants it.

Also teach both probes to tell the failure modes apart instead of one opaque
message: 401 = key rejected (stale/instance-encrypted -> re-provision),
403 = key OK but right 251 missing (-> grant it / re-provision), 200 = armed.
Docs updated accordingly (checkpoint SKILL.md probe outcomes, sandbox-write
SKILL.md gotcha, test/README.md rights table synced to WRITE_IDS incl. 262/111).

Co-Authored-By: Claude Fable 5 <[email protected]>

.claude/skills/dolibarr-sandbox-checkpoint/SKILL.md

@@ -29,7 +29,12 @@ arcodange sandbox checkpoint relink-env
 ```
 
 1. **`status`** — HTTP liveness + whether the write agent (`ai_agent_sandbox`) is
-   *armed* (its key authenticates `GET /users/info`). Read-only, no cluster access.
+   *armed*. The armed probe calls `GET /users/info` with the linked key; three
+   outcomes: **200** → `ARMED`; **401** → the key itself is rejected (stale, e.g.
+   an iso-prod refresh re-encrypted it) → re-run `provision`; **403** → the key
+   authenticates but lacks right **251** (`user → lire`, which `/users/info`
+   requires) → re-provision (a fresh run grants it via `WRITE_IDS` in
+   `test/provisionSandbox.ts`) or grant 251 by hand. Read-only, no cluster access.
 2. **`refresh --yes`** — re-seed the sandbox iso-prod from prod, wrapping
    `ops/sandbox/sandbox-lifecycle.sh` (read-only `pg_dump` of prod → `DROP OWNED` →
    `pg_restore`, then documents/logo sync). **Destructive**: requires `--yes`, and
@@ -40,7 +45,8 @@ arcodange sandbox checkpoint relink-env
    (`test/provisionSandbox.ts`). It opens a browser; **you complete the admin
    login** — with the **PROD** admin credentials, since the sandbox is iso-prod
    (they come from `test/.env.sandbox`). The POC re-grants the agent's rights
-   (including `banque lire`) and writes the key to `test/.ai_agent_sandbox.key`,
+   (including `banque lire` and `user lire` = right 251, which the armed probe
+   needs) and writes the key to `test/.ai_agent_sandbox.key`,
    then this command auto-runs `relink-env`. Needs `deno`.
 4. **`relink-env`** — (re)write `dolibarr-sandbox-write/.env` from
    `test/.ai_agent_sandbox.key` (mode 600) and verify it authenticates. Run it

.claude/skills/dolibarr-sandbox-checkpoint/scripts/checkpoint-relink-env.sh

@@ -24,7 +24,13 @@ printf 'verify: '
 "${DOLW}" GET /users/info | python3 -c "import json,sys
 d = json.load(sys.stdin)
 if isinstance(d, dict) and d.get('login'):
-    print('OK — armed as %s (id %s)' % (d['login'], d.get('id')))
+    print('OK — armed as %s (id %s)' % (d['login'], d.get('id'))); sys.exit(0)
+err = d.get('error', {}) if isinstance(d, dict) else {}
+code = str(err.get('code', ''))
+if code == '401':
+    print('FAILED — 401 key rejected (stale/instance-encrypted) → re-run checkpoint provision')
+elif code == '403':
+    print('FAILED — 403 key authenticates but right 251 (user lire) is missing → re-provision or grant 251 (WRITE_IDS, test/provisionSandbox.ts)')
 else:
-    msg = d.get('error', {}).get('message', '?') if isinstance(d, dict) else str(d)
-    print('FAILED — %s' % msg); sys.exit(1)"
+    print('FAILED — %s' % (err.get('message', '?') if isinstance(d, dict) else str(d)))
+sys.exit(1)"

.claude/skills/dolibarr-sandbox-checkpoint/scripts/checkpoint-status.sh

@@ -22,10 +22,15 @@ try:
 except Exception:
     print('NOT armed — no/invalid response'); sys.exit(0)
 if isinstance(d, dict) and d.get('login'):
-    print('ARMED — login=%s id=%s' % (d['login'], d.get('id')))
+    print('ARMED — login=%s id=%s' % (d['login'], d.get('id'))); sys.exit(0)
+err = d.get('error', {}) if isinstance(d, dict) else {}
+code = str(err.get('code', ''))
+if code == '401':
+    print('NOT armed — 401 key rejected (stale after a refresh?) → run checkpoint provision')
+elif code == '403':
+    print('NOT armed — 403 key OK but right 251 (user lire) missing → re-provision or grant 251 (WRITE_IDS, test/provisionSandbox.ts)')
 else:
-    msg = d.get('error', {}).get('message', '?') if isinstance(d, dict) else 'unexpected'
-    print('NOT armed — %s' % msg[:80])"
+    print('NOT armed — %s' % str(err.get('message', 'unexpected'))[:80])"
 else
   echo "  write .env     : ABSENT"
   echo "  write agent    : not linked — run 'arcodange sandbox checkpoint relink-env' after provisioning"