55 lines
4.1 KiB
Markdown
55 lines
4.1 KiB
Markdown
# `[2026-09-16]` Grok token broker — built, then shelved by the transport ruling. Do NOT arm the probe.
|
||
|
||
**`services/grok-token-broker/` — seeded, committed, DISARMED, no consumer.** Commits `ebc4dac`
|
||
`b907a0e` `cf9d167`. ⛔ **Do not arm `probe-rotation`.** This is a finished resting place, not a
|
||
half-built tool: the gate works and the thing it gated for went away.
|
||
|
||
**Operator ruling, relayed by heid:** *"keep the jail stop the a/b"*
|
||
(`heid dispatch-log/2026-09.jsonl#groa-transport-20260916-operator-keeps-the-jail`, alongside
|
||
`#groa-transport-ab-20260916-operator-stop`). Gróa dispatches through the read jail;
|
||
`groa_http_dispatch.py` is a documented fallback with no scheduled use. **Nothing in the fleet
|
||
wants a renewable xAI session.**
|
||
|
||
⭐ **THE CODE-PLAN ENDPOINT EXISTS and I was one message away from telling the operator it did
|
||
not.** `https://cli-chat-proxy.grok.com/v1` serving **grok-4.6** (500,000 context) and grok-4.5,
|
||
`agent_type: grok-build-plan`, `auth_method: session`, `api_key`/`env_key`/`api_base_url` all
|
||
null. ⚠⚠ **It is in `~/.grok/models_cache.json` — the Grok CLI's own config, on nh3-dev.** I had
|
||
swept heid's repo, the gateway `.env`, the LiteLLM config and Vaultwarden, all correctly, and
|
||
concluded "does not exist". ⭐ **heid's line, taken: absence from the places you searched is not
|
||
absence.** The check that separates the two states is a LIVE REQUEST, not a grep.
|
||
|
||
⚠⚠ **NOT WRITING `~/.grok/auth.json` IS NECESSARY AND NOT SUFFICIENT.** The refresh grant at
|
||
`https://auth.x.ai/oauth2/token` may ROTATE the refresh token, and many OIDC providers invalidate
|
||
the old one SERVER-SIDE. A broker refreshing the same credential kills the CLI login even though
|
||
it never touches the file. heid's module header reasoned about the WRITE; they amended it to name
|
||
invalidation, credited. This correction went infra-ops→heid the same day heid's went the other
|
||
way — **neither of us reaches the right answer alone.**
|
||
|
||
⚠⚠ **THE PROBE'S BLAST RADIUS IS BOTH GRÓA TRANSPORTS, which is not visible from the infra side.**
|
||
`heid/scripts/groa_dispatch.py` builds `argv = ["grok", "-p", prompt, "--cwd", jail, ...]` and
|
||
shells the CLI, which authenticates from the same `~/.grok/auth.json`. The bwrap in the process
|
||
table is grok's own Landlock sandbox, not something Heid wraps. **One session, two ways of
|
||
reaching it** — an invalidating probe takes Gróa down on EVERY path until an interactive re-login.
|
||
🔴 **I had recommended "run the probe now while the CLI is idle" and withdrew it in writing**;
|
||
"idle" was a convenient assumption I never checked, on a day that had already taken eight panels.
|
||
|
||
**Why the jail won, and it was not performance.** HTTP is faster (~523 s median vs ~890 s),
|
||
simpler, and arguably SAFER on confinement (no tools, so the 2026-06-10 escape class is
|
||
structurally impossible). It lost on FAILURE MODE: HTTP fails by returning a fast, confident,
|
||
well-formatted review that found nothing — indistinguishable from a clean bill. The jail fails by
|
||
timing out, which you can see. ⚠ **Do NOT quote a per-transport finding rate from this**: heid
|
||
states the 0/0/0-vs-5/7/3 numbers are confounded with bundle size (the zeros were all huge inline
|
||
bundles; the one HTTP round at jail-comparable size produced Gróa's leading solo), n=3–4 per cell,
|
||
no noise floor. Asymmetric-risk argument, **not** a resolved measurement.
|
||
|
||
⚠ **Still unmeasured, and it is a billing question:** the jail reaches the coding plan already
|
||
paid for; the HTTP path reaches the METERED API and its responses carry `cost_in_usd_ticks`.
|
||
Whether that bills on top of the plan was never part of the ruling. One look at the xAI billing
|
||
console — **this fleet holds no xAI credential**, so it needs the operator's account access.
|
||
|
||
⚠ The coding plan speaks the **Responses API** (`api_backend: "responses"`), not
|
||
`/chat/completions` — a second, independent obstacle to any LiteLLM alias. Moot while the jail is
|
||
ruled. heid also found and killed two live instructions in their own persistent-memory telling a
|
||
fresh session to dispatch `--groa-transport http`; either would have resumed a stopped experiment
|
||
after a context reset.
|