4.1 KiB
[2026-09-16] Grok token broker — built, then shelved by the transport ruling. Do NOT arm the probe.
services/grok-token-broker/ — seeded, committed, DISARMED, no consumer. Commits ebc4dac
b907a0e cf9d167. ⛔ Do not arm probe-rotation. This is a finished resting place, not a
half-built tool: the gate works and the thing it gated for went away.
Operator ruling, relayed by heid: "keep the jail stop the a/b"
(heid dispatch-log/2026-09.jsonl#groa-transport-20260916-operator-keeps-the-jail, alongside
#groa-transport-ab-20260916-operator-stop). Gróa dispatches through the read jail;
groa_http_dispatch.py is a documented fallback with no scheduled use. Nothing in the fleet
wants a renewable xAI session.
⭐ THE CODE-PLAN ENDPOINT EXISTS and I was one message away from telling the operator it did
not. https://cli-chat-proxy.grok.com/v1 serving grok-4.6 (500,000 context) and grok-4.5,
agent_type: grok-build-plan, auth_method: session, api_key/env_key/api_base_url all
null. ⚠⚠ It is in ~/.grok/models_cache.json — the Grok CLI's own config, on nh3-dev. I had
swept heid's repo, the gateway .env, the LiteLLM config and Vaultwarden, all correctly, and
concluded "does not exist". ⭐ heid's line, taken: absence from the places you searched is not
absence. The check that separates the two states is a LIVE REQUEST, not a grep.
⚠⚠ NOT WRITING ~/.grok/auth.json IS NECESSARY AND NOT SUFFICIENT. The refresh grant at
https://auth.x.ai/oauth2/token may ROTATE the refresh token, and many OIDC providers invalidate
the old one SERVER-SIDE. A broker refreshing the same credential kills the CLI login even though
it never touches the file. heid's module header reasoned about the WRITE; they amended it to name
invalidation, credited. This correction went infra-ops→heid the same day heid's went the other
way — neither of us reaches the right answer alone.
⚠⚠ THE PROBE'S BLAST RADIUS IS BOTH GRÓA TRANSPORTS, which is not visible from the infra side.
heid/scripts/groa_dispatch.py builds argv = ["grok", "-p", prompt, "--cwd", jail, ...] and
shells the CLI, which authenticates from the same ~/.grok/auth.json. The bwrap in the process
table is grok's own Landlock sandbox, not something Heid wraps. One session, two ways of
reaching it — an invalidating probe takes Gróa down on EVERY path until an interactive re-login.
🔴 I had recommended "run the probe now while the CLI is idle" and withdrew it in writing;
"idle" was a convenient assumption I never checked, on a day that had already taken eight panels.
Why the jail won, and it was not performance. HTTP is faster (~523 s median vs ~890 s), simpler, and arguably SAFER on confinement (no tools, so the 2026-06-10 escape class is structurally impossible). It lost on FAILURE MODE: HTTP fails by returning a fast, confident, well-formatted review that found nothing — indistinguishable from a clean bill. The jail fails by timing out, which you can see. ⚠ Do NOT quote a per-transport finding rate from this: heid states the 0/0/0-vs-5/7/3 numbers are confounded with bundle size (the zeros were all huge inline bundles; the one HTTP round at jail-comparable size produced Gróa's leading solo), n=3–4 per cell, no noise floor. Asymmetric-risk argument, not a resolved measurement.
⚠ Still unmeasured, and it is a billing question: the jail reaches the coding plan already
paid for; the HTTP path reaches the METERED API and its responses carry cost_in_usd_ticks.
Whether that bills on top of the plan was never part of the ruling. One look at the xAI billing
console — this fleet holds no xAI credential, so it needs the operator's account access.
⚠ The coding plan speaks the Responses API (api_backend: "responses"), not
/chat/completions — a second, independent obstacle to any LiteLLM alias. Moot while the jail is
ruled. heid also found and killed two live instructions in their own persistent-memory telling a
fresh session to dispatch --groa-transport http; either would have resumed a stopped experiment
after a context reset.