# `[2026-09-16]` Grok token broker — built, then shelved by the transport ruling. Do NOT arm the probe.

**`services/grok-token-broker/` — seeded, committed, DISARMED, no consumer.** Commits `ebc4dac`
`b907a0e` `cf9d167`. ⛔ **Do not arm `probe-rotation`.** This is a finished resting place, not a
half-built tool: the gate works and the thing it gated for went away.

**Operator ruling, relayed by heid:** *"keep the jail stop the a/b"*
(`heid dispatch-log/2026-09.jsonl#groa-transport-20260916-operator-keeps-the-jail`, alongside
`#groa-transport-ab-20260916-operator-stop`). Gróa dispatches through the read jail;
`groa_http_dispatch.py` is a documented fallback with no scheduled use. **Nothing in the fleet
wants a renewable xAI session.**

⭐ **THE CODE-PLAN ENDPOINT EXISTS and I was one message away from telling the operator it did
not.** `https://cli-chat-proxy.grok.com/v1` serving **grok-4.6** (500,000 context) and grok-4.5,
`agent_type: grok-build-plan`, `auth_method: session`, `api_key`/`env_key`/`api_base_url` all
null. ⚠⚠ **It is in `~/.grok/models_cache.json` — the Grok CLI's own config, on nh3-dev.** I had
swept heid's repo, the gateway `.env`, the LiteLLM config and Vaultwarden, all correctly, and
concluded "does not exist". ⭐ **heid's line, taken: absence from the places you searched is not
absence.** The check that separates the two states is a LIVE REQUEST, not a grep.

⚠⚠ **NOT WRITING `~/.grok/auth.json` IS NECESSARY AND NOT SUFFICIENT.** The refresh grant at
`https://auth.x.ai/oauth2/token` may ROTATE the refresh token, and many OIDC providers invalidate
the old one SERVER-SIDE. A broker refreshing the same credential kills the CLI login even though
it never touches the file. heid's module header reasoned about the WRITE; they amended it to name
invalidation, credited. This correction went infra-ops→heid the same day heid's went the other
way — **neither of us reaches the right answer alone.**

⚠⚠ **THE PROBE'S BLAST RADIUS IS BOTH GRÓA TRANSPORTS, which is not visible from the infra side.**
`heid/scripts/groa_dispatch.py` builds `argv = ["grok", "-p", prompt, "--cwd", jail, ...]` and
shells the CLI, which authenticates from the same `~/.grok/auth.json`. The bwrap in the process
table is grok's own Landlock sandbox, not something Heid wraps. **One session, two ways of
reaching it** — an invalidating probe takes Gróa down on EVERY path until an interactive re-login.
🔴 **I had recommended "run the probe now while the CLI is idle" and withdrew it in writing**;
"idle" was a convenient assumption I never checked, on a day that had already taken eight panels.

**Why the jail won, and it was not performance.** HTTP is faster (~523 s median vs ~890 s),
simpler, and arguably SAFER on confinement (no tools, so the 2026-06-10 escape class is
structurally impossible). It lost on FAILURE MODE: HTTP fails by returning a fast, confident,
well-formatted review that found nothing — indistinguishable from a clean bill. The jail fails by
timing out, which you can see. ⚠ **Do NOT quote a per-transport finding rate from this**: heid
states the 0/0/0-vs-5/7/3 numbers are confounded with bundle size (the zeros were all huge inline
bundles; the one HTTP round at jail-comparable size produced Gróa's leading solo), n=3–4 per cell,
no noise floor. Asymmetric-risk argument, **not** a resolved measurement.

⚠ **Still unmeasured, and it is a billing question:** the jail reaches the coding plan already
paid for; the HTTP path reaches the METERED API and its responses carry `cost_in_usd_ticks`.
Whether that bills on top of the plan was never part of the ruling. One look at the xAI billing
console — **this fleet holds no xAI credential**, so it needs the operator's account access.

⚠ The coding plan speaks the **Responses API** (`api_backend: "responses"`), not
`/chat/completions` — a second, independent obstacle to any LiteLLM alias. Moot while the jail is
ruled. heid also found and killed two live instructions in their own persistent-memory telling a
fresh session to dispatch `--groa-transport http`; either would have resumed a stopped experiment
after a context reset.