fix(rebalance): check needs no signer, and a failed check is as loud as a fired one

[robertleifke]

The defect

check is the command meant to run unattended on a timer. It reads two balances and a price and signs nothing — but cli.ts built a KMS account before the switch regardless of command, so it required AWS credentials it never used. It died on an expired SSO session.

A scheduled monitor that fails whenever a human's login lapses is not a monitor.

Three changes, because the first alone would be undone

1. createReadClient() builds chain reads only, and check() is typed to ReadClients — tsc now refuses any future edit that reaches for a signer there.

2. A test that proves it. cli.ts takes injectable readClients / signingClients, and cli.test.ts asserts the signing factory is never called for check or quote, with a negative control asserting deposit does call it — so the first two can't pass for the wrong reason.

The regression guarded against is specific: hoisting client creation above the switch again. That typechecks, leaves CI green, and breaks only the unattended path.

3. A failed check now alerts. Unattended, a crash into a log nobody reads is the same failure mode as an alert that reaches nobody. A run that can't complete posts to the same webhook a real finding would use:

cNGN rebalance check FAILED TO RUN (sub 15): <why>. Inventory is UNKNOWN, not healthy — nothing has been checked.

The wording is deliberate: a failed check must never read as a clean bill of health. It still exits non-zero, so a scheduler's OnFailure catches the case where the webhook itself is what broke.

Two more defects found while testing

• cli.ts ran main() at module scope, so importing it executed the CLI and threw on loadConfig before a test could reach anything. Now guarded on being the entry point.
• --alert validated ALERT_WEBHOOK_URL only at the point of sending — which is after the healthy-verdict early return. So check --alert on a timer with no webhook configured would look fine for as long as the inventory was fine, and fail for the first time on the run that finally had something to say. Validated up front now.

That second one was found by a test written against the old behaviour. It failed, and it was right to — I changed the code, not the test.

Verification

Against the exact failure that exposed it — AWS_PROFILE unset, AWS config and credentials files at /dev/null, SSO still expired:

sub 15      USDC 307.991878469619934771 / cNGN 478661.280616
rate        1368.3155 (snapshot 2026-09-21T14:06:06.000Z)
valued      USDC $307.99 / cNGN $349.82 (cNGN 53.2%)
action      none
EXIT: 0

21 tests pass; ./scripts/verify.sh node green.

Note what that output is: check's own thresholds, price source and inventory definition reporting the verdict. A previous claim that "no rebalance is due" came from reading the balances directly after the command failed — which confirmed a reimplementation of the logic, not the logic itself.

🤖 Generated with Claude Code