[aaltshuler]

What & why

Operator aliases currently load their binding from one operator configuration, then reread the file for server and credential selection. Replacing the file while --params-file is being read can redirect the alias to another server. Served cluster commands likewise read the file separately for endpoint and credential selection, repeating configuration warnings.

Pass the alias caller's captured configuration through execution setup and load it once in RemoteCluster. Remove the obsolete server/token helpers that loaded configuration implicitly. Keep live credential lookup, root versus graph-specific credential matching, alias parameter precedence, and literal/named error ordering. Update the user guide, architecture guide and changelog.

Backing issue / RFC

• Implements the accepted operator-resolution contracts in RFC 0007 and RFC 0011.

Fourth CLI refactor slice discussed in #675. Depends on #1039: this branch starts at 112a3980; the new commit contains this slice. The PR targets main and therefore includes that prerequisite until it is merged and this branch is rebased.

Checklist

• Change is focused (one logical change)
• Tests added/updated for behavior changes
• Public docs and changelog updated
• Reviewed against docs/dev/invariants.md; no Hard Invariant weakened or deny-list item hit

Local verification

Clean baseline: 19 unit tests and six integration journeys passed, including the existing ignored live-apply journey run explicitly. Before production changes, the new alias regression failed because the destination changed and the named-cluster regression failed because configuration warnings appeared twice. The error-precedence regression passed on both versions.

After the change: all 29 focused tests pass (19 unit, three new integration tests, seven compatibility journeys). The Unix alias regression uses a bounded FIFO handshake to replace configuration after binding selection; it has no timing race or production hook. It verifies graph/query destination, graph-specific credentials, parameter precedence and warning counts. Cluster coverage checks named/literal setup, token precedence, unauthenticated discovery and invalid-address errors preceding malformed-config errors.

Cargo ran from the worktree with CARGO_TARGET_DIR=/Users/andrew/code/omnigraph/target. Compatibility journeys used CARGO_BIN_EXE_omnigraph-server=/Users/andrew/code/omnigraph/target/debug/omnigraph-server from the same main baseline.

cargo test -p omnigraph-cli --bin omnigraph --locked -- \
  helpers::tests:: tests::resolve_remote_bearer_token_falls_back_to_default_env \
  client::tests::graph_http_over_a_unix_socket_sends_root_relative_targets_issue_979 \
  operator::tests::find_server_for_url_longest_prefix_no_substring_traps
cargo test -p omnigraph-cli --test integration --locked -- \
  cli_queries::alias_setup_keeps_one_operator_config_across_params_file \
  cli_cluster::core_remote_
cargo test -p omnigraph-cli --test integration --locked -- --include-ignored \
  cli_queries::alias_flag_is_removed_from_query \
  cli_queries::alias_unknown_name_errors_listing_defined \
  cli_queries::alias_rejects_global_scope_flags_that_the_binding_owns \
  system_local::local_cli_operator_alias_and_server_flag_invoke_stored_query \
  system_local::local_cli_keyed_credentials_authenticate_url_matched_server \
  cli_cluster::core_live_apply_captures_server_file_root_without_local_storage_access \
  cli_data::ordinary_client_setup_keeps_one_operator_config_across_discovery
cargo clippy -p omnigraph-cli --all-targets --locked -- -D warnings -W clippy::dbg_macro
cargo fmt --all --check
/Users/andrew/code/omnigraph/.venv-docs/bin/python scripts/check-docs.py
bash scripts/check-agents-md.sh
typos crates/omnigraph-cli/src/client.rs crates/omnigraph-cli/src/cluster_remote.rs \
  crates/omnigraph-cli/src/helpers.rs crates/omnigraph-cli/src/main.rs \
  crates/omnigraph-cli/src/main_tests.rs \
  crates/omnigraph-cli/tests/integration/cli_queries.rs \
  crates/omnigraph-cli/tests/integration/cli_cluster.rs \
  docs/dev/architecture.md docs/user/cli/index.md \
  changelog.d/cli-remote-config-snapshot.fixed.md
git diff --check

Notes for reviewers

This completes captured configuration for ordinary remote-client setup. Rendering still loads its own preferences, and managed provisioning keeps its existing owners. The CLI grammar, engine and HTTP contracts are unchanged. Tests exercise the CLI process boundary; GQT retains query-semantic ownership. Full workspace tests were not run locally; CI remains pending.

[aaltshuler]

Superseded by #1047, which merged the complete CLI refactor, its delivery and configuration fixes, and the latest main integrations as 02026b5. Closing this incremental slice because its implementation is now on main.