# JIT plan — REQ-ALT-ACCOUNT-ROOTS (alt account roots)

Board: `BigscreenVR/claude-spt-bs#13`, greenlit 2026-08-21. Decision: `docs/adr/0010-account-roots-are-per-account-with-junctioned-continuity.md`.
Vocabulary: `CONTEXT.md` (account · config root · account root · shared continuity tree · alt profile).

## Scope

Ship the ability to run a session under a DIFFERENT Anthropic account without logging out
of the first, by launching Claude Code against an adapter-owned account root.

Deliverable is small on purpose: **one shipped example profile, a launch-shim flag, a
one-shot init, docs, tests.** NOT a subsystem, and explicitly not a reimplementation of
ccs's instance manager (its per-launch maintenance is the cost being removed).

OUT: settings-type profiles (non-Anthropic backends), provider swapping, removing ccs.
`claude-spt:ccs` is untouched and ccs stays installed.

## Layout (settled — do not re-derive)

    ~/.claude-spt/
      shared/                     one node-wide continuity tree
        projects/ todos/ file-history/ shell-snapshots/ session-env/
      accounts/<account>/         = CLAUDE_CONFIG_DIR for one alt profile
        .credentials.json         REAL FILE — one login, every endpoint
        .claude.json              REAL FILE — identity + trust
        projects/ -> junction into ../../shared/projects   (and the rest of the set)
        skills/ agents/ commands/ settings.json -> junction/link to the primary root's

Load-bearing, measured 2026-08-21 (see the REQ for the evidence): `.claude.json` is
rewritten with a NEW FILE IDENTITY every ~15-25s under a live session, so NOTHING
account-bound may be a link — it would stop tracking on the first rewrite and diverge
silently. Directories use JUNCTIONS (no elevation needed; Windows file symlinks need
Developer Mode).

## Open questions, decided here so the build does not stall

1. **Init vs maintenance.** Init is ONE-SHOT and idempotent: create missing dirs/junctions,
   seed trust, exit. It NEVER runs at launch — per-launch maintenance is what makes ccs slow.
   A launch against a missing root fails with "run init", it does not silently build one.
2. **Trust seed source.** Copy the `projects` map entries (path + `hasTrustDialogAccepted`)
   from the CURRENT config root's `.claude.json` into the new root's. Trust is
   per-config-root and an unseeded root HANGS on the dialog rather than failing.
3. **Missing credentials at launch.** PROCEED, do not refuse — operator ruling 2026-08-21:
   "`:alt` literally doesn't need to do anything special for a fresh account root. when spt
   launches the endpoint, claude code will prompt for login, and once the user logs in, that
   endpoint's session starts." This SUPERSEDES the pre-flight-refusal I recommended during
   the grilling. Emit a one-line notice, then exec.

## Tasks

- T1  Shim: `claude-spt launch --account <name>` — resolve `~/.claude-spt/accounts/<name>`,
      set `CLAUDE_CONFIG_DIR`, exec the harness binary. Missing root = loud error naming init.
- T2  Init: `claude-spt alt init <account>` — create the account root + the shared tree,
      junction the continuity set + the authoring surface, seed trust (decision 2), print the
      one-time login instruction. Idempotent. Junctions on Windows via `cmd /c mklink /J`
      (std's symlink_dir needs privilege); plain symlinks elsewhere.
- T3  Manifest: shipped `[profiles.alt.*]` overlaying the launch command for EVERY spawned
      role — `session.self`, `session.resume`, `session.psyche_init`, `session.echo_commune`
      — plus a `[profiles.alt.strings] adapter_label` so the resolve is observable.
- T4  Docs: how a user adds their OWN account with `spt adapter create-profile` (exists in
      core — nothing to build). Note there is no `{profile}` substitution key, so each
      overlay names its account literally.
- T5  Tests `tests/alt-account-roots.sh`: root layout; junctions created; NOTHING
      account-bound is a link (the regression that guards the measurement); trust seeded;
      launch against a missing root errors; launch with no credentials PROCEEDS.
- T6  Activate `REQ-ALT-ACCOUNT-ROOTS` with `required_stages = ["impl","unit"]` and tag the
      evidence IN THE SAME COMMIT as the code (activate-don't-pre-fail: not before).
- T7  Release: CHANGELOG section + adapter version bump, gates, build all THREE triples
      fresh (incl. musl), pack, tag, `gh release create`, then the public mirror LAST.
      Runbook: `docs/RELEASE-RUNBOOK.md`.

## Gate

`sh ci/run-gates.sh` PASS **and** `traceable-reqs check` exit 0 before any commit.
READ THOSE EXIT CODES DIRECTLY — `cmd > log 2>&1; echo $?`. A pipe (`| tail`, `| grep`)
reports the LAST stage's status and already hid a red gate once this session.