[teamleaderleo]

Defines the account scope, device-code prompt, access-only grant, and VM transport used by the Codex broker. The transport requires the authenticated attach endpoint to return exactly vmKind: owner and the running daemon capability, pins the team, and installs private access files with a privileged transaction. No refresh credential enters the VM.

This is the 295-line independently landing prerequisite split from #26170; that PR supplies the caller and registration/renewal lifecycle. Guest-controlled marker files cannot establish ownership; the authoritative API distinguishes creator-owned machines from team/shared machines. The daemon bridge supplies codex-external-access-v1 and reads the documented access-only JSON contract. Wizard activation follows the complete reviewed stack.

Relevant notes:

Setup wizard
New cloud workspace
Figure out what you want to transfer into the api key from current machine to new machine.. claude setup-token
Always need new claude credentials, that kind of suck

Official operational rules:

Use one auth.json per runner or per serialized workflow stream.
Do not share the same file across concurrent jobs or multiple machines.

Codex account auth in CI/CD. The dedicated local holder retains the rotating auth state; this transport carries only short-lived access. cmux must remain running on the user's Mac to renew VM access.

Validation: pr-overlap found no overlaps. Whole-PR prepush gate passed at da68f64d0e81bafc60fa9a8898e8e58bb7ba703e; regressions exercise the real API target with spoofed guest owner markers, team/missing/null/unknown ownership, API errors, and capability gating. Combined exact-stack cmux-ci run 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7 (step bbc58714e6ed0d379fa0dca8) exited 0: App/test compile plus eight suites and 57 tests. Coverage was native 7, target 4, holder-pipe 5, and adapter 15. Independent xhigh review remains coordinated with the rest of the stack. This domain/transport prerequisite adds no visible UI; no capture artifact applies to this non-rendered model/transport code.

Agent session: agent session

[github-actions]

cmux status _{(one comment, edited in place; each line is updated by the job that owns it)}

Review da68f64: HQ feed card · gallery before/after runs · checks

App of this head (app.zip, kept 1 day)

gh workflow run reload-build.yml -R manaflow-ai/cmux --ref feat-cmux-next -f tag=pr26269 -f ref=cloud-setup-codex-broker-target -f platform=macos -f backend_mode=local

[blacksmith-sh]

Found 2 test failures on Blacksmith runners:

Failures

Test	View Logs
nightly.yml must derive the embedded key and sign every appcast through the helper/ nightly.yml must derive the embedded key and sign every appcast through the helper	View Logs
test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)/ test_the_repository_highlights_validate (main.DigestTests.test_the_repository_highl ights_validate)	View Logs

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[teamleaderleo]

Bead cx-h5qjqy created for this PR by the cmux coordinator.

[teamleaderleo]

Exact-head check reconciliation for da68f64d0e81bafc60fa9a8898e8e58bb7ba703e:

• Release-notary on the PR head fails the same three checks as the actual base 370fc6137dc80e33c553dd1e15dec86fb3e8fe71: repository highlight validation in scripts/whats-new/test_digest.py, the assertion in tests/test_nightly_sparkle_key.sh, and test_the_appcast_comes_from_the_tested_plist (ValueError: substring not found) in tests/test_nightly_legacy_publish_linux.py. The scripts, nightly workflow, and release notes they inspect are unchanged by this PR.
• The app compile job was refused by runner admission after waiting for capacity; it never compiled source. Exact target/model source was subsequently compiled in combined integration 0888de20c0ef36ad479f6dc0a9a5b5cadf75aeb7, cmux-ci step bbc58714e6ed0d379fa0dca8, exit 0. All four CloudCodexBrokerTargetTests passed, including rejection of a guest-spoofed ownership marker. The full combined run passed eight suites / 57 tests.

Independent exact-head review remains required before landing.

[github-actions]

Shipped in:

• cmux NEXT nightly 1.0.0-nightly.4058380124501 (efc7808a36)
• cmux NEXT nightly 1.0.0-nightly.4058596012902 (efc7808a36)
• cmux NEXT nightly 1.0.0-nightly.4059411161803 (cc0d757245)