codex: expose auth broker pr preflight contract

scripts/src/auth-broker.ts

@@ -124,6 +124,17 @@ function brokerNeededResult(options: BrokerAdapterOptions): Record<string, unkno
     message: "No auth broker endpoint is configured for this dry-run contract; runner env token coverage is reported only for migration diagnostics.",
     tokenCoverage: runnerEnvTokenCoverage(),
     brokerCoverage: brokerCoverage(options.endpoint),
+    authBroker: {
+      ok: false,
+      source: "broker/auth-broker-needed",
+      capability: "missing-token",
+      nextAction: "configure-auth-broker",
+      runnerEnvTokenRequired: false,
+      brokerIssuedTokenAvailable: false,
+      valuesRead: false,
+      valuesPrinted: false,
+      realPrCreateRequiresCommanderAuthorization: true,
+    },
     next: [
       "configure UNIDESK_AUTH_BROKER_URL or AUTH_BROKER_URL for broker-backed runner auth",
       "keep GH_TOKEN/GITHUB_TOKEN out of ordinary runner env once broker mode is enabled",
@@ -185,6 +196,17 @@ function readyContract(options: BrokerAdapterOptions): Record<string, unknown> {
     dryRun: true,
     mutation: false,
     capabilities: [...DEFAULT_CAPABILITIES],
+    authBroker: {
+      ok: true,
+      source: "auth-broker",
+      capability: "broker-issued-token",
+      nextAction: "use-auth-broker",
+      runnerEnvTokenRequired: false,
+      brokerIssuedTokenAvailable: true,
+      valuesRead: false,
+      valuesPrinted: false,
+      realPrCreateRequiresCommanderAuthorization: true,
+    },
     tokenCoverage: {
       ok: true,
       source: "auth-broker",
@@ -199,9 +221,11 @@ function readyContract(options: BrokerAdapterOptions): Record<string, unknown> {
     prCapabilityContract: {
       targetBranch: options.base,
       headBranch: options.head,
+      authSource: "broker-issued-token",
       systemGhBinaryRequiredForWrites: false,
       preflightCreatesPr: false,
       preflightMergesPr: false,
+      realPrCreateRequiresCommanderAuthorization: true,
       brokerProxy: {
         ok: true,
         operations: ["github.auth.status", "github.issue.read", "github.pr.read", "github.pr.create"],