Codex + Cursor worker turns on one gunbai-secrets credential each (custody, spawn, grants)

[gunbai-bot]

Node adhoc-932f2935-e8e. Builds on #13367 (wise-ibex-444, Claude), which is merged into this branch: the shared executor route, the env-from-file wrapper and the custody pattern. Once #13367 lands, this diff shrinks to the Codex/Cursor part.

Operator rulings this implements (relayed by swift-ibex-601, 2026-10-05)

• Codex uses subscription (chatgpt) mode, not API-key mode.
• No codex chatgptAuthTokens login. It is upstream-labelled [UNSTABLE] FOR OPENAI INTERNAL USE ONLY - DO NOT USE (codex-rs app-server-protocol v2/account.rs).
• Credentials are delivered by host custody under the fleet-converge run's WIF. No worker turn touches Secret Manager.
• codex-auth-harness lives on exactly one custody host, and Codex dispatch is pinned to it.

Why Codex needs write-back (source-read, not inferred)

extdeps.llm.codex_auth now records the refresh path from github.com/openai/codex@7f892275, codex-rs/login auth/manager.rs:

• When it refreshes: should_refresh_proactively fires within 5 minutes of access-token expiry, so roughly hourly.
• It writes back: persist_tokens writes auth.json back, including the returned refresh_token.
• The issuer detects reuse: refresh_token_reused maps to RefreshTokenFailedReason::Exhausted.
• No cross-process lock: the refresh lock is per process.

Whether the issuer rotates the refresh token on every exchange stays CodexRotationUnobserved until it is observed. The experiment runs on a throwaway login, never the production secret.

What lands

Custody (gunbc.host_credential_custody_converge)

• New CursorWorkerTurnApiKey and CodexWorkerTurnAuth rows, both on srv2.
• CustodyAuthority marks the Codex row host-authoritative after placement. A Codex auth.json that differs from the store is never overwritten:
  • if only short-lived tokens moved, it is left in place;
  • if the refresh token rotated, the host file is added to codex-auth-harness as a new version, then re-read from the host;
  • if it names another account, the converge refuses.
• Placement refuses any host-authoritative row scoped to many hosts. The single-host rule is structural, not a convention.

Spawn (gunbc.roadmap_dispatch_actuator dispatch_provider_inner_argv_for_instance)

• Cursor: cursor-agent --print with stream-json, --force, --sandbox enabled and --trust. CURSOR_API_KEY is exported from the custody file inside the child (extdeps.posix.sh_invocation), never on argv.
• Codex: codex exec with CODEX_HOME set to the custody directory, under flock --exclusive --nonblock --conflict-exit-code 75. The new extdeps.tools.util_linux_flock models it, and the lock lives exactly as long as the process.
• Off the custody host: CursorProviderOffCustodyHost / CodexProviderOffCustodyHost refusals. This replaces the ambient Codex login path.
• Behaviour change: the srv1 lab instance codex-provider-feedback-v0 can no longer spawn Codex. That follows the single-host ruling.

Grants (gunbc.auth.fleet_secret_accessor_roster)

• secretAccessor on both secrets.
• secretVersionAdder on codex-auth-harness, for the converge's write-back.

Both are folded by the existing converge and approval entries. The census row for the custody site covers the write-back.

Cursor credential (gunbc.cursor_harness_credential)

• cursor-api-key-harness is pinned to an exact version (1), per the existing rule that Cursor never reads latest.
• with_materialized_secret with an EnvVar binding.
• Liveness comes from cursor-agent status --format json, which is ProbeInert. The witness's rejected-key output is copied from cursor-agent 2026.10.01.
• The declared srv2 Cursor offer now carries the harness secret instead of CursorLocalLoginRef.

Other changes

• extdeps.llm.cursor_cli: CursorRunShape separates the run from the credential, so the argv has one authority.
• fleet-converge.yml: regenerated, adding the custody credential options.

Residual windows

• Store lags the host: a Codex token rotated on the host reaches the store only at the next custody converge. Losing the host in that window means the operator logs in again; the next dispatch refuses rather than running on a spent token.
• Converge reads during a write: a converge that reads auth.json while Codex is mid-write refuses at parse and retries next run.

Declared frontier B: a workload identity bound to the turn runner on the custody host would let a turn persist the rotation immediately. Trigger: select_access_token_source resolves a federated token on that host outside an Actions run.

Limits

• Codex: limits are already read from the CLI (rateLimits → ProviderLimitObservation), and dispatch skips an exhausted bucket.
• Cursor: cursor-agent 2026.10.01 exposes no usage or limits command. How exhaustion appears in a turn's output is observed with the live key, in a follow-up.

Witnesses

File	Pass	Covers
test.claim.codex_harness_credential	8	Payload admission; write-back owed vs not owed; account change; unreadable read-back
test.claim.cursor_harness_credential	9	Accepted vs rejected key through the real bracket; unprobed; store axis; route over the declared srv2 inventory
test.claim.host_credential_custody_converge	43	Host-authoritative differing file left or written back, never overwritten; many-host Codex row refused, Cursor row still placed; Codex delivered only to srv2
test.claim.worker_turn_dispatch_witness_test	4	The production spawn fold on the srv1/srv2 instances, both providers, both arms
test.claim.gcp_secret_access	37	Version-adder grant; the roster identity join, which was red on main

Pre-existing, not from this PR: two alignment witnesses in roadmap_dispatch_actuator_witness_test also fail on main at 5e9c7ea1. Their subject 2-scm-git-upstream-model gained a parent.

Still needed before the live turns

1. The operator creates cursor-api-key-harness. Payload: the raw Cursor API key, one line, no trailing newline.
2. The operator creates codex-auth-harness. Payload: a fresh auth.json (auth_mode chatgpt) from a login in a throwaway CODEX_HOME that no running codex uses afterwards.
3. Run the accessor + versionAdder ensure via approval.
4. Run the custody converge for both rows on srv2.
5. One live turn per provider through ?executor=codex|cursor.

🤖 Generated with Claude Code

[gunbai-bot]

On review 76372: all three findings are on extdeps.posix.sh_invocation (posix_sh_export_from_file_then_exec_script / _words / _command). That module is #13367's (wise-ibex-444), and this branch carries it only through the merge of #13367. To keep one writer per file, the fix lands in #13367: an env-name carrier, and the read-export-exec protocol moved out of extdeps or modeled with a dissolution trigger. I'll merge it here once it's pushed and retype this PR's one call site (Cursor's cursor_api_key_env_var in gunbc.cursor_harness_credential cursor_worker_turn_argv) to the new carrier. The reviewer notes the new extdeps.tools.util_linux_flock row is a faithful upstream model; it stays as is. — sent from swift-stag-32

[gunbai-bot]

Review 76372 is addressed: #13367's fix is merged in at b3321e2.

• Typed variable name: extdeps.posix.shell_command_language PosixShellName has a sole constructor and is minted only by admit_posix_shell_name (XBD 3.235). The shell wrapper takes only that type.
• Cursor call site: gunbc.cursor_harness_credential cursor_worker_turn_argv now admits CURSOR_API_KEY before it builds the wrapper. A refused name surfaces as a new CursorProviderCredentialUnbound arm with spawn step cursor-credential-binding, kept distinct from the custody-host refusal.
• Scaffold marker and dissolution trigger: Drive Claude (subscription setup-token) from belt dispatch via an explicit executor request #13367 has them on the wrapper.
• Layer placement: the wrapper stays in extdeps. Its module comment states the divergence and the reason: the ArgvCommand mint admits only per-tool extdeps builders. Which variable, credential and path to use stays in the gunbc credential layer.

Witnesses run with claim_batch on BuildBuddy:

Witness file	Result
worker_turn_dispatch	4/4
cursor_harness_credential	9/9
claude_code_dispatch	22/22
roadmap_dispatch_actuator	50/52

The two roadmap_dispatch_actuator failures (the_preamble_names_the_derived_refusal_for_an_unrooted_node, an_unresolved_alignment_refuses_the_real_spawn_fold_with_zero_commands) also fail on main at 5e9c7ea. Their subject node 2-scm-git-upstream-model gained a parent there.

[briansrls]

LAND at ff14668. This approval supersedes my REQUEST_CHANGES review 5433130046. No remaining merge-blocking finding from me for the current custody workflow and the previously accepted staged activation scope.

Reviewed ca6ad6a directly, its final production callers, the decision witnesses, and ff14668's one-line RemoteFileModeOwnerReadWrite import. The delta from 035cd96 is exactly these two commits.

The metadata rollback is closed: custody_action's identical-content/wrong-metadata CustodyWrite is mapped by host_authoritative_custody_action to CustodyRepairMetadataInPlace. converge_host_credential_custody executes only chown/chmod on the existing path for that arm; it does not invoke the store-byte stage/rename writer. If A was observed and the host refreshes to B before metadata repair, B survives. Because this arm has no host_content reading, the final comparison may still compare against A and refuse; that is fail-closed stale observation, not a rollback or a false success.

First placement is now CustodyCreateOnly: stage -> chown staged file -> chmod staged file -> ln -T staged destination, without -f. An independently appearing destination makes publication fail rather than being overwritten. The failed leg is retained as write_refusal, staging cleanup and metadata/content readback still run, and custody_run_settled cannot report success over that failure. Store-authoritative rows retain the existing CustodyWrite behavior. Existing matching and differing host-authoritative cases retain leave/write-back/refusal behavior.

Independent EXECUTED local GNU-utility controls, using dummy credentials only (not gunbc, its emitter, its decision functions, SSH transport, or Codex): (1) in-place A->B refresh followed by chown/chmod preserved B and its inode, set 0600, and cmp against old A exited 1; (2) atomic-replacement A->B refresh gave the same result; (3) absent destination published A successfully and staging cleanup left one link; (4) B appearing after staging made ln exit 1 and left B and its inode untouched; (5) a destination directory and (6) a destination symlink were each preserved with ln exit 1. All six controls passed. This supplements the source review; it does not turn the added decision/dispatch witnesses into an enrolled end-to-end execution witness.

Scope clarification: this is not an endorsement of arbitrary concurrent invocations of the raw create_only_publish helper. The fixed .gunbc-staging name and hard-link publication rely on the existing serialized custody route. I checked fleet_converge_workflow: HostCredentialCustodyConverge maps to the shared job and ExecutorDomain; its job uses the host mutation concurrency group with cancel_in_progress=false. Preserve that serialization. Supporting parallel custody writers would need private, exclusively owned staging and cleanup, not ln -T alone. This is not a new landing condition for the current route.

The earlier instance/standing and Cursor snapshot repairs retain their accepted disposition. Codex's unobserved runtime-fingerprint gate and Cursor's unmodeled entitlement trip remain activation work; approval does not claim either provider is already selectable or live-qualified.

Verified workflow 37523876216 on this exact head: emit-build, floor, generated, rust-unit-tests, and witnesses all completed successfully. Normal merge-queue checks still apply. No queue, merge, grant, or credential action taken.

[gunbai-bot]

Heads-up before queueing: this PR adds import v2.std.optional, but #13388 re-homed that module to std.optional, so it no longer resolves on main. The PR's own run may pass because it predates main's change. In the merge queue it will fail the floor (unresolved import: module 'v2.std.optional' not found) and fail every merge group behind it, as #13359 and #13440 did. Please merge main in and repoint those imports to std.optional before enqueueing. — sent from swift-bat-828