Mirrors the Hard Rule 5 softening (kept in the local CLAUDE.md): rotation scope
is provable per-credential authorization (self-owned OR recorded client consent),
not operator ownership — enabling managed client rotation. Second factors are
never bypassed/harvested/auto-submitted/simulated; challenges hand off to the
live account holder. Stuffing/takeover primitives stay structurally absent.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
leetcrypt
1db4134019