/**
 * Child-job authentication against a read-only HQ state directory.
 *
 * WHY (client report + live reproduction 2026-08-10)
 * --------------------------------------------------
 * "The parent runner can authenticate and reach every provider, but the skill
 * subprocesses cannot use that machine authentication. They fall back to
 * refreshing a human HQ session, which then fails because the job's HQ state
 * directory is read-only."
 *
 * Two independent defects produced that:
 *
 *  1. The state dir was hardcoded to `os.homedir()/.hq` with no override, while
 *     the CREDS path already had one (HQ_MACHINE_CREDS_FILE). So auth required
 *     a writable HOME even for a machine identity: with valid machine creds and
 *     a read-only `~/.hq`, `getValidMachineTokens` died on the lock candidate
 *     write with EACCES *before any network call*.
 *
 *  2. A machine context that cannot find its creds does not error —
 *     `isMachineIdentity()` returns false and the caller proceeds to the human
 *     path, which on a headless box tries to open a browser and hangs.
 *
 * These tests pin the fixes: HQ_STATE_DIR redirects state, writes degrade
 * instead of throwing, and HQ_REQUIRE_MACHINE_IDENTITY makes the downgrade loud.
 */
export {};
//# sourceMappingURL=read-only-state-dir.test.d.ts.map