[fwkyle]

Summary

• A startup ownership-discovery timeout currently becomes a process-lifetime sibling mark. The new proxy can then bind both its normal and data-loopback ports while considering the loopback port its owner, permanently refusing Codex model refresh with HTTP 409 sibling_instance until restart.
• Refuse a new start on an indeterminate cross-home ownership verdict, before listener binding, runtime publication, or shared-client writes. A subsequent start performs fresh discovery. Proven owners still produce siblings, and existing same-home sibling recovery during owner downtime is unchanged.
• Add deadline-exhaustion/recovery regression coverage and assert that unreadable or legacy ownership evidence refuses startup without publishing a runtime or altering shared client files. Update startup and ownership documentation.

Verification

Verified at c5e17b50b2c3508d023c0ec560c7a1e2ca128812, based on dev at 7640a942b35044c974e534b84d5a8049f4a8ae9a:

• OCX_TEST_RUNNER_BUN=<Bun 1.4.3 binary> bun run test:changed — 34 passed, 0 failed; selected 1 of 2,325 test files.
• Bun 1.4.3: bun test tests/cli/start-ownership-publication.test.ts tests/server/management-route-registry.test.ts — 29 passed, 0 failed, including management rejection boundaries and listener/runtime publication ordering.
• bun run typecheck, bun run structure:check, bun run privacy:scan, and git diff --check origin/dev...HEAD — passed.
• cd docs-site then bun run build — passed; 577 pages and 81,203 internal links checked.
• Local installed-package verification before rebasing: reproduced HTTP 409 sibling_instance; after applying the same runtime patch and restarting the service, the new runtime had no sibling mark and authenticated POST /api/sync returned HTTP 200 with ok: true, status: applied.

The full local suite has not been run. This is a draft with focused validation; broader platform CI and maintainer security review remain pending. The historical cause of the original local connection delay is unknown; this change fixes the incorrect durable topology decision rather than weakening ownership verification or increasing probe timeouts.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Maintainer security review requested for the ownership boundary. The change preserves fail-closed behavior; no authentication, attestation, or management-route permission is relaxed.

Review readiness checklist

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

⏳ DRAFT

• review readiness checklist open (0/4 boxes ticked).

What to do

• Tick all four boxes in the PR description once you're done (currently 0/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ⬜ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

0/4 boxes ticked.

This PR stays in draft until every box above is ticked.

[lidge-jun]

Superseded by #7142, which carries this work with Co-authored-by credit. Thank you!

[lidge-jun]

Thank you, @fwkyle. I've carried this onto an upstream branch in #7142, so the repository's full CI (including the macOS and Windows matrix) can run on it. Your commits are kept and credited with a Co-authored-by trailer. Follow-up fixes there address the open review findings; the description of #7142 lists them. I'm keeping this PR open until #7142 lands, then I'll close it as merged by carry.