Cookie Auth Opt-In and Source Labeling Contracts
Phase 16 Step 16.2 added failing tests that define the product behavior before implementation.
Behavior Covered
- Manual credential entry remains the default.
- Browser cookie reading requires explicit consent before any read attempt.
- Permission denial falls back to manual entry with user-facing copy.
- Cookie-sourced credentials are labeled separately from manual and Claude Code credentials.
- Expired cookie results prompt browser-login refresh instead of silently saving credentials.
Evidence
swift test --filter CookieAuthPreferencesTests and swift test --filter CookieAuthSettingsViewTests fail as expected because the Step 16.3+ implementation surfaces do not exist yet.