Wave 1: bind Grok account leases to immutable Codeg profiles

[James3014]

Status

P0 / OWNER_AUTHORIZED / READY_AFTER_GROK_POOL_REBIND / AUTO_CHAIN=false

Owner goal: complete multi-account Wave 0 + Wave 1 without widening provider routing authority.

Current source watermarks at creation:

• DevSpace main@45ce06a51ab2af43f513ab49ad111be4cc8cc48c
• Wave 2: add durable DevSpace -> Codeg thin execution bridge #224 thin-bridge Candidate efc197bf3e7fdc49d357dab91eafc9eb152b9451 remains the execution-plane base for this follow-up; it is not merged to main.
• Nexus-new feat: enforce projected tools at provider adapters #192 / PR fix(mcp): settle the /mcp auth wait when bearer auth writes the response Waishnav/devspace#353 is the canonical Grok account-pool source contract.

Goal

Bind an already-selected Grok AccountLease / credential profile to one immutable Codeg execution profile so two Grok accounts can execute without mutating a machine-global active account.

The host-level provider remains grok. This Issue does not choose provider/model or perform cross-provider fallback.

Authority boundary

Nexus / account owner
   -> ExternalAccountPool / Grok pool selects account lease
        -> DevSpace thin bridge consumes opaque binding
             -> Codeg immutable execution profile
                  -> Grok with profile-scoped GROK_HOME

• Nexus-new owns account selection, health, cooldown, failure classification and lease lifetime.
• DevSpace owns durable execution binding and safe projection.
• Codeg owns process/session execution.
• Grok owns credential/session bytes.
• CapabilityPlanner/provider routing, acceptance, merge, release and production authority remain unchanged.

Preferred no-upstream-Codeg adaptation

First prove Codeg's existing custom-agent registry can represent immutable Grok profiles:

• one profile definition per leased credential home;
• pinned Grok package/command compatible with built-in Grok ACP;
• profile env contains only the machine-local GROK_HOME binding and required non-secret launch settings;
• host/API never receives raw credential bytes;
• Codeg work task may use the immutable custom profile internally.

If this experiment preserves the required physical identity/readback, prefer it over modifying Codeg upstream.

If custom-agent identity cannot truthfully satisfy the logical Grok provider receipt/verification contract, STOP and require a contract delta for a typed per-task account_binding_id; do not expose arbitrary runtime_env.

Required DevSpace behavior

1. Public dispatch remains logical route grok; caller cannot submit arbitrary Codeg custom agent IDs or environment variables.
2. Request may bind an opaque, prevalidated account lease/profile reference. DevSpace does not select another account.
3. Persist logical provider, non-secret account hash/lease identity, and physical Codeg profile ID/task ID in the durable operation receipt.
4. Exact replay of one attempt/lease returns the same operation; conflicting lease/profile reuse fails closed.
5. Restart/reconcile preserves the same account binding and physical task identity; never reacquire a different account silently.
6. Cancel affects only the bound task and does not release/rotate unrelated leases.
7. Secret-safe projection: no raw alias, GROK_HOME physical path, auth/session bytes, token or Codeg bearer token leaves the trusted machine boundary.
8. Provider/account failures are reported back as structured evidence for the canonical Grok pool; DevSpace MUST NOT itself decide rotation.
9. Existing Wave 2: add durable DevSpace -> Codeg thin execution bridge #224 authority guards remain: Codeg auto_process=false, auto_merge=false, delegation=false.
10. No existing local-agent adapter removal, merge/cutover, release, production activation or Wave 2 auto-chain.

Runtime evidence already available

Machine-local metadata currently reports three enabled Grok profile homes:

• primary
• grok-02
• grok-03

Only profile existence/state metadata may be used for planning. Credential bytes must not be read or committed.

Acceptance — Wave 1

Source:

• focused tests prove opaque lease/profile binding, replay conflict, restart preservation, exact cancel, secret-safe receipt, non-selector behavior and authority containment;
• strict MCP schema rejects raw path/env/custom-agent injection;
• typecheck/build/diff checks pass.

Disposable runtime:

1. create/resolve two distinct existing Grok profiles A/B without copying credentials;
2. Codeg launches A and B with distinct immutable GROK_HOME values/profile identities;
3. two concurrent/overlapping consumers cannot contaminate each other's HOME/session state;
4. each profile can produce an independently attributable Grok ACP/session result when its provider entitlement is available;
5. deliberately exhausted/unavailable account evidence is surfaced to the account pool without DevSpace selecting B itself;
6. release/reacquire is fenced and stale lease replay fails closed;
7. disposable baseline and Candidate worktrees remain clean.

Wave 1 completion ceiling:
GROK_ACCOUNT_LEASE_TO_CODEG_PROFILE_BINDING_VERIFIED

This does not close #224 W2.6 automatically and does not imply independent acceptance/merge/release.

Execution guidance

• lane: bounded DIRECT_DELEGATED
• implementation: local isolated DevSpace worktree stacked on Wave 2: add durable DevSpace -> Codeg thin execution bridge #224 Candidate
• worker: Codex CLI / Luna xhigh after fresh preflight
• coordinator independently inspects diff and reruns verifiers
• claim mode: MANUAL_DISPATCH
• no worker self-merge
• AUTO_CHAIN=false

[James3014]

CONTRACT_DELTA — Wave 0 mechanism selected from runtime probes

Wave 0 experiments were run only against disposable Codeg v0.31.1 data/ports and did not modify production Codeg or credential contents.

Observed:

1. Codeg custom-agent registry can persist immutable GROK_HOME env and launch the Grok ACP package. custom:grok-profile-a reached ACP Initialize successfully.
2. That route is not acceptable for the final binding: its physical identity is AgentType::Custom, so Codeg does not apply built-in Grok authentication semantics; session/new failed Authentication required: no auth method id provided.
3. Built-in Grok with per-agent/server GROK_HOME creates session state under the intended profile home, proving state-path isolation, but historical grok-02 / grok-03 credentials currently advertise only interactive grok.com auth, not reusable cached_token. This is credential freshness, not permission to copy credentials.
4. Therefore do not patch custom agents to impersonate Grok and do not expose arbitrary runtime env.

Selected binding

ISOLATED_CODEG_RUNTIME_PROFILE

Each canonical Grok AccountLease binds to an opaque trusted runtime profile id. DevSpace resolves that id through machine-local configuration to one Codeg endpoint/token whose process/runtime is provisioned for exactly that account profile. Codeg continues to execute built-in AgentType::Grok.

Public request/receipt boundary:

• caller may provide only opaque accountBindingId plus non-secret canonical lease/account evidence;
• caller may NOT provide endpoint, token, GROK_HOME, filesystem path, env map, or custom agent id;
• durable receipt may expose binding id + non-secret account hash + Codeg task id, never endpoint token/profile path;
• DevSpace consumes the selected binding; it MUST NOT choose another account on quota/auth failure;
• restart/reconcile must reuse the same binding/transport identity; no silent account reacquire;
• exact replay with a different binding fails closed.

Trusted local configuration owns accountBindingId -> Codeg endpoint/token. This is execution plumbing only, not a second account registry/health selector.

Source implementation gate

Implement #226 stacked on #224 Candidate efc197bf3e7fdc49d357dab91eafc9eb152b9451:

• extend the Codeg bridge with a trusted transport resolver keyed by opaque binding id;
• public MCP schema keeps logical route grok and rejects raw endpoint/token/path/env/custom-agent injection;
• preserve existing single transport for unbound routes;
• persist binding identity in durable request/receipt and enforce replay/restart/cancel invariants;
• add config validation + secret-safe tests.

Runtime provisioning gate

The existing grok-02 and grok-03 homes need fresh legitimate login before two-account model-call witnesses can pass. Do not duplicate primary credentials to satisfy this gate. Login/provisioning remains human account authority.

AUTO_CHAIN=false. This delta does not start W2.6 or authorize merge/cutover/release.

[James3014]

Wave 1 Grok lease -> Codeg profile binding source receipt

CAUSAL_WATERMARK

• current devspace/main: 45ce06a51ab2af43f513ab49ad111be4cc8cc48c
• stacked Wave 2: add durable DevSpace -> Codeg thin execution bridge #224 bridge subject: 926a1b22fd6822ca39f2109c16bf03de7371ad28
• Wave 1: bind Grok account leases to immutable Codeg profiles #226 Candidate: 4bd57ebe39d1f6e8a429dc843748b6f313d875c1
• Candidate tree: aaf420642629b055873b5ef60eb25459ede5d478
• changed paths: exactly four
  • src/codeg-bridge.ts
  • src/codeg-bridge.test.ts
  • src/server.ts
  • src/server.test.ts

Implemented boundary:

• public logical route remains grok;
• caller may provide only strict accountBinding = { leaseId, accountAliasHash };
• leaseId must be lease_<32 lowercase hex>;
• accountAliasHash must be exactly 12 lowercase hex;
• bound Grok maps internally to custom:nexus-grok-<accountAliasHash>;
• caller cannot provide GROK_HOME, raw path/env, or physical custom-agent id;
• bound Grok also rejects non-empty generic configValues so that surface cannot smuggle profile/env-like overrides;
• durable request hash/replay binds the lease/hash;
• durable receipt preserves only secret-safe logical route / lease id / account hash / physical agent correlation;
• status, reconcile and cancel verify the exact derived physical agent identity;
• DevSpace does not select, rotate, or fail over accounts.

False-green defenses added during coordinator review:

1. bound Grok + configValues { GROK_HOME: ... } rejects before any Codeg transport call;
2. strict nested MCP schema negative controls use a real opened workspace and prove grokHome, runtimeEnv, and customAgentId are rejected while transport call count remains zero.

Independent coordinator rerun on the frozen diff:

• Codeg bridge tests: 16/16 PASS
• server Codeg focused tests: 2/2 PASS
• TypeScript tsc --noEmit: PASS
• git diff --check: PASS
• production npm run build: PASS
• scope: exactly the four allowed files
• worktree clean after Candidate commit
• no push, merge, cutover, release or W2.6 auto-chain

Runtime boundary:

• existing secondary homes grok-02 and grok-03 are physically isolated from primary;
• read-only Grok entitlement probes report both secondary homes as You are not authenticated.;
• therefore a true A/B live provider witness is currently blocked only by secondary-account OAuth/device-auth provisioning, not by Wave 1: bind Grok account leases to immutable Codeg profiles #226 source behavior.

Current ceiling:
GROK_ACCOUNT_LEASE_TO_CODEG_PROFILE_BINDING_SOURCE_VERIFIED

Keep #226 open until at least one secondary Grok profile is legitimately authenticated and the disposable DevSpace->Codeg bound-profile runtime witness completes. Do not copy primary credentials or bypass the login gate.

[James3014]

OWNER HOLD — freeze Codeg-specific Grok binding; preserve account-identity invariant

Fresh DevSpace main: 3f8d6c12c4986c0af806944d9aaa7c3427fb0380.

The Codeg-specific implementation path in #226 is frozen while #235 qualifies HerdR.

Preserve the real invariant for any future runtime:

• exact Grok account/lease identity must be immutable for one attempt;
• no silent GROK_HOME/account substitution;
• restart/reconcile must address the same logical account binding;
• secrets remain private;
• cancel/release cannot affect sibling identities.

Do not port Codeg profile mechanics mechanically into HerdR. If #235 reaches its additional-provider breadth gate, Grok account binding must be re-proven against HerdR's actual per-process/workspace environment and session surfaces.

No source mutation or account rebinding is authorized by this comment.