Execute the R2 object-read token mint and retire its Create frontier rows

[gunbai-bot]

Summary

• Ran cloudflare.AccountTokens.Create through gunbc.cloudflare.r2_token_mint_run, stored the token value via gunbc.secret_provision, and pinned origin-read custody to cloudflare-r2-origin-read-token version 1.
• THREE Creates ran on the live account. The first two hit RestOk with unread nested fields because output paths were dotted JSON-pointer keys (result.id), not slashes (result/id). Those minted live credentials that had to be revoked by name:
  • 3cbb99f150c4daec03ab6a8458a2440f (gunbai-fabric-origin-object-read) — revoked
  • cb444492f55dbc1b40ee7ce17778d7ff (gunbai-fabric-origin-object-read) — revoked
    Identities come from the account token listing after each Create, which was the only readback of those two mints. The surviving stored mint is 3f43e1c7f8fbcfc97139cb5d9dc4e984 (token id / S3 access key id, not a secret).
• Frontier rows in gunbc.cloudflare.r2_token_mint retire on the THIRD Create's executed evidence specifically (ExitSuccess, custody at Secret Manager versions/1). They do not retire on the first two RestOk exchanges.
• Filed gunbc.recurring_failure_mode.json_pointer_dot_spelling_reads_nested_fields_as_absent: a decided success whose nested fields read as absent can replay a non-idempotent mutation. Not a 5xx/timeout retry.

Test plan

• AccessVersion of bootstrap secret versions/1 (not latest)
• gunbc run … --function run ExitSuccess on the third Create; receipt at Secret Manager versions/1
• Two unheld tokens revoked by name after listing; third Create is the stored mint
• claim-run: retired frontier, receipt grain, origin pin, create-response fail-closed, census

Made with Cursor

[gunbai-bot]

Addressed review 63165:

1. Replaced the grain-boolean / same-row token_id == s3_access_key_id witness with r2_object_read_mint_receipt_names_the_origin_read_pin, which joins version_resource to the origin read_credential via gcp_resource_names_this_version (the same identity join the bootstrap fetch uses).
2. AccountTokens.Delete RestOk now refuses when deleted.success is false before writing a revoke receipt.
3. r2_object_read_token_mint_retrieved_at is now the retrieved_at field of r2_object_read_token_mint_receipt.

— sent from jolly-ram-785

[gunbai-bot]

Review 63174 had no findings. Review 63179 (later SHA) had two that were real:

1. revoke_unheld_object_read_token now refuses when the listed id is r2_object_read_token_mint_receipt.token_id with custody established (object_read_token_id_is_held_in_custody). The held mint is no longer deletable as "unheld."
2. r2_token_mint_create_frontier_rows_are_retired now asserts absence of admit_r2_object_read_api_mint, admit_account_token_api_mint, and r2_s3_access_pair_from_created_token by declaration identity, not length() == 0.

— sent from jolly-ram-785

[gunbai-bot]

Addressed review 63190:

1. r2_mint_bootstrap is the one admission/custody fetch. list_account_tokens is the one List decode. run, probe_bootstrap_access_version, list_account_tokens_for_reconcile, and revoke_unheld_object_read_token consume those folds.
2. Revoke no longer compares a listed id to the receipt literal. It refuses Delete when origin_read_pin_is_exact (origin read_credential version is not latest). The stored secret is the token value; listing does not return it, so the live declaration that custody exists is the pin.
3. Receipt fields that no fold read are gone. The row is token_id + version_resource. Revoked unread Creates are r2_object_read_tokens_revoked_before_store, joined as not equal to the surviving id.

/tmp writes stay as the operator readback of List/probe/run; they are not a second mint path.

— sent from jolly-ram-785

[gunbai-bot]

Addressed review 63196:

1. Deleted surviving_mint_id_is_not_a_revoked_unread_create and revoke_unheld_refuses_when_origin_read_is_pinned. Those compared authored literals. origin_read_pin_is_exact now takes a DurableOriginStanding; the RED is a latest-pin fixture, the positive control is the declared origin.
2. Removed the transcribed receipt row and the revoked-id list. The three Create identities stay in the module annotation and the PR body. The pin join is secret_ref_version_resource of the origin declaration against fleet_secrets_project_number, not a pasted Secret Manager string.
3. Deleted probe_bootstrap_access_version — run already fetches bootstrap before Create. list_account_tokens_for_reconcile and revoke_unheld_object_read_token stay: they are gunbc-run reconcile entries for a non-idempotent Create (the same consumer class as run), and they are the executing consumers of List/Delete. They dissolve when a modeled artifact store replaces the /tmp write.

— sent from jolly-ram-785