From cf9d1674536aa3322f3dcd313f8cec5486ff1a0d Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Wed, 16 Sep 2026 16:04:29 -0700 Subject: [PATCH] =?UTF-8?q?grok-token-broker:=20shelved=20=E2=80=94=20oper?= =?UTF-8?q?ator=20kept=20the=20jail,=20so=20the=20renewal=20feature=20has?= =?UTF-8?q?=20no=20consumer?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- services/grok-token-broker/README.md | 31 ++++++++++++++++++++++++---- 1 file changed, 27 insertions(+), 4 deletions(-) diff --git a/services/grok-token-broker/README.md b/services/grok-token-broker/README.md index 6439191..738f6ce 100644 --- a/services/grok-token-broker/README.md +++ b/services/grok-token-broker/README.md @@ -49,11 +49,34 @@ transport **share one session**: one reaches it through the CLI, the other reads wrote. An invalidating probe takes **Gróa down on every transport** until a human re-logs in — not "the HTTP path degrades". Caught by `heid`, confirmed here against their source. -## Current state +## Current state — ⛔ SHELVED, deliberately, 2026-09-16 -Seeded on **nh3-dev** 2026-09-16. Scope `openid profile email offline_access grok-cli:access -api:access`, client `b1a00492-…`. **Probe NOT yet run** — it is the operator's call when to -spend it. +**Seeded, committed, disarmed, and with no consumer. Do NOT arm `probe-rotation`.** This is a +finished resting place, not a half-built tool — the gate is working exactly as designed and the +thing it was gating for went away. + +Operator ruling the same day, relayed by `heid`: *"keep the jail stop the a/b."* Heid dispatches +Gróa through the read jail; `groa_http_dispatch.py` is kept as a documented fallback with no +scheduled use. **Nothing in the fleet is asking for a renewable xAI session.** + +So the trade inverted while the tool was being built: + + the RISK did not shrink -- an invalidating probe still reaches BOTH Gróa transports through + the shared `~/.grok/auth.json` session, taking the arm down until an interactive re-login + the PAYOFF went to zero -- it buys token renewal on a transport nobody dispatches + +⭐ **If something later needs a renewable xAI session, the argument reopens on its own merits +and this is sitting here ready.** That is the whole reason it was left seeded rather than torn +out. Re-read the probe warning below before arming it; none of that risk expired. + +Scope `openid profile email offline_access grok-cli:access api:access`, client `b1a00492-…`. +Probe verdict: **UNMEASURED**, and correctly so. + +⚠ **One question this never answered, and it is a billing one:** the jail reaches the coding +plan already paid for; the HTTP path reaches the metered API, whose responses carry a +`cost_in_usd_ticks` field. Whether that bills *on top of* the plan was never measured and was +not part of the ruling. It is one look at the xAI billing console, which this fleet holds no +credential for. ## For a consumer