fix(e2e-account): route CI-only error codes to coverage allowlist; untrack dump.rdb

The e2e-account error codes (not_test_cohort, team_create_failed,
user_create_failed, tier_not_allowed, tier_set_failed, rand_failed) are
operator/CI-only — emitted only on the guarded /internal/e2e/account surface
that is inert by default (404 unless E2E_ACCOUNT_TOKEN is set) and driven by
the machine-to-machine E2E harness, never a customer agent.

They were previously added to codeToAgentAction with operator-facing copy,
which violated the customer-facing agent_action contract (TestAgentActionContract
requires every entry to start "Tell the user ..." and carry a customer recovery
URL). Move them to error_envelope_coverage_test.go's coverageAllowlist with a
per-code rationale instead: the 503 arms fall back to AgentActionContactSupport
via respondError's status>=500 path; the 4xx arms (400/403/429) carry a
self-explanatory message with no agent_action, which is correct for a CI caller.

Also untrack dump.rdb (local Redis artifact accidentally committed) and add it
to .gitignore.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805

.gitignore

@@ -8,3 +8,6 @@ node_modules
 
 # Internal Claude Code skills (per-repo)
 .claude/
+
+# Local Redis dump artifact — never commit
+dump.rdb

dump.rdb

@@ -45,6 +45,21 @@ var coverageAllowlist = map[string]string{
 	// real handler call sites. Filtered by the test (see emitCode).
 	"code": "regex artefact — not a real emit",
 	"x":    "regex artefact — not a real emit",
+
+	// CI-only ephemeral-test-account surface (POST/DELETE /internal/e2e/account).
+	// These codes are emitted only on the operator/CI-guarded endpoint, which is
+	// inert by default (404 unless E2E_ACCOUNT_TOKEN is set) and driven by the
+	// machine-to-machine E2E harness — never a customer agent. A customer-style
+	// "Tell the user … https://instanode.dev/…" agent_action would be wrong for
+	// a CI caller, so they intentionally carry no codeToAgentAction entry: the
+	// 503 arms fall back to AgentActionContactSupport, the 4xx arms to an empty
+	// agent_action with a self-explanatory message.
+	"not_test_cohort":    "CI-only /internal/e2e/account reap-safety 403 (machine-to-machine; not customer-facing)",
+	"team_create_failed": "CI-only /internal/e2e/account mint 503 (machine-to-machine; not customer-facing)",
+	"user_create_failed": "CI-only /internal/e2e/account mint 503 (machine-to-machine; not customer-facing)",
+	"tier_not_allowed":   "CI-only /internal/e2e/account gated-tier 400 (machine-to-machine; not customer-facing)",
+	"tier_set_failed":    "CI-only /internal/e2e/account mint 503 (machine-to-machine; not customer-facing)",
+	"rand_failed":        "CI-only /internal/e2e/account mint 503 (machine-to-machine; not customer-facing)",
 }
 
 // TestErrorCode_HasAgentAction is the registry-iterating coverage gate.

internal/handlers/error_envelope_coverage_test.go

@@ -1199,30 +1199,17 @@ var codeToAgentAction = map[string]errorCodeMeta{
 		AgentAction: "Tell the user this action requires a fresh session (admin-scope PAT mints need re-auth). Sign in again at https://instanode.dev/login — see https://instanode.dev/docs/auth.",
 	},
 
-	// ── CI-only ephemeral-test-account surface (POST/DELETE /internal/e2e/account) ──
-	// These codes only ever surface to the CI harness driving the guarded
-	// E2E_ACCOUNT_TOKEN endpoint — never to a real customer agent (the route
-	// is inert/404 unless the token is configured). The agent_action is
-	// therefore operator-facing: it points at the token + request shape rather
-	// than a customer recovery URL.
-	"not_test_cohort": {
-		AgentAction: "This is the guarded CI test-account endpoint: the target team is not in the test cohort, so it can never be reaped here. Operators: only is_test_cohort teams minted via POST /internal/e2e/account are reapable — check the team_id in the request.",
-	},
-	"rand_failed": {
-		AgentAction: "This is the guarded CI test-account endpoint: secure random generation failed while minting the account id. Operators: retry; if it persists the host's entropy source is unavailable.",
-	},
-	"team_create_failed": {
-		AgentAction: "This is the guarded CI test-account endpoint: creating the test team failed. Operators: check platform_db connectivity and the E2E_ACCOUNT_TOKEN / request before retrying.",
-	},
-	"tier_not_allowed": {
-		AgentAction: "This is the guarded CI test-account endpoint: the requested tier is not mintable here. Operators: pass an allowed tier (free/hobby/hobby_plus/pro) in the request — see the endpoint's tier allowlist.",
-	},
-	"tier_set_failed": {
-		AgentAction: "This is the guarded CI test-account endpoint: elevating the test team to the requested tier failed. Operators: check platform_db connectivity and the request before retrying.",
-	},
-	"user_create_failed": {
-		AgentAction: "This is the guarded CI test-account endpoint: creating the test primary user failed. Operators: check platform_db connectivity and the E2E_ACCOUNT_TOKEN / request before retrying.",
-	},
+	// NOTE: the CI-only ephemeral-test-account error codes (not_test_cohort,
+	// team_create_failed, user_create_failed, tier_not_allowed, tier_set_failed,
+	// rand_failed) are deliberately NOT registered here. codeToAgentAction holds
+	// CUSTOMER-facing agent guidance — the contract test (TestAgentActionContract)
+	// requires every entry to start "Tell the user …" and carry a customer
+	// recovery URL. The /internal/e2e/account surface is operator/CI-only and
+	// inert by default (404 unless E2E_ACCOUNT_TOKEN is set), so its codes never
+	// reach a customer agent: the 503 arms already get the generic
+	// AgentActionContactSupport via respondError's status>=500 fallback, and the
+	// 4xx arms (400/403/429) carry a self-explanatory message with no
+	// agent_action — correct for a machine-to-machine CI caller.
 }
 
 // ErrorResponse is the canonical JSON shape for every 4xx/5xx response.