test(e2e): cover user auth after service principal error

[ruiconti]

What

• require the service-triggered turn to call connection_search, record the expected user-principal failure, and finish on the next model step
• continue the same session as a human and require a fresh ClickState search to emit authorization.required for that current user
• mirror the ClickState URL, read-only tool allowlist, and user-scoped authorization contract in a self-contained fixture

An automated investigation can fail to load a user-scoped connection because its active principal is service. That failed tool call remains in session history. The eval checks the event order directly: failed action.result, next step.started, then the terminal service reply.

When a human continues the session, the model must be offered connection_search again. If it calls the tool, eve must resolve auth.current to the human instead of reusing the service principal.

The fixture uses deterministic interactive authorization instead of @vercel/connect/eve, because e2e fixtures cannot depend on Vercel OIDC, connector installation, or an external MCP server. Its authorization challenge includes the resolved principal ID, so the assertion proves the human became current.

This covers the eve history and authorization contract under the existing Sol and Opus e2e matrix. It does not add Terra to every fixture or independently prove a Terra-only tool-selection regression. Fixture-only; no runtime change or changeset.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
eve-docs	Ready	Preview, Comment, Open in v0	Jul 28, 2026 12:48am

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
eve-docs-1644	Skipped	Open in v0	Jul 28, 2026 12:48am
eve-docs-4759	Skipped	Open in v0	Jul 28, 2026 12:48am