[jjangg96]

Related to #1. This PR does not close G01.

Change

• The v3 reusable-callee broker makes one self-revocation attempt for the narrowly scoped read-only installation token after provider preflight and before the final workflow check or write-token mint.
• A syntactically valid bounded token returned with rejected read-only scope/expiry data remains a cleanup candidate. It is revoked once with a durable intent and is never used for provider-state preflight.
• If the returned read token equals the caller workflow-verification token, the broker durably records the collision and stops before provider-state preflight or DELETE.
• After a successful DELETE, failure to durably record the revoked result triggers a best-effort terminal uncertainty record. No later workflow check, write mint or handoff occurs.
• Follow-up coverage injects a revoked-record sync failure through the full broker execution path, proves the uncertainty fence prevents later writes, and asserts exactly one DELETE in rejected-token and uncertain-revocation fixtures.
• Token values remain absent from broker journal records. The evidence separates source-level credential custody and planned resource budget from still-open live runtime and headroom checks.

Review triage

Independent Luna Max review of prior head 7a5c6e2a57de2015cd2d540194ddad49a83a24a9 approved the bounded offline/static change, found no P0/P1 defects, and held all live gates. Its two P2 evidence gaps—full-path revoked-record sync fault injection and exact DELETE counts—were addressed in 8bbf43ead63bdcfce8615a87c4038d84db30f6ed. Follow-up review at 8bbf43e found a P2 test-seam concurrency risk from a mutable package-global opener. Commit 1ea35587f5df5fa6b7c1b5c34bc87689a8a02061 replaces it with per-execution context-scoped fault injection; production contexts carry no hook and use the canonical opener. A separate independent Luna Max review of prior exact head d8f387fdc7e367ac65e23a3b449ee7202aff2163 returned HOLD: P1 because caller-token equality was checked only after DELETE (broker.go:308,312-321); P1 because a valid token returned with rejected scope/expiry could be discarded before cleanup (broker_api.go:231-235, broker.go:301-304); and P2 because a successful DELETE followed by journal append/sync failure had no durable uncertainty marker (broker.go:321). The remediation is present in candidate commits 4f3d84f, 8bbf43e and 1ea3558, including full-path fault coverage, exact DELETE counts and per-execution fault-hook scope. A fresh Luna Max review of exact head 1ea35587f5df5fa6b7c1b5c34bc87689a8a02061, including the open live-harness checklist, has been queued; its verdict is pending. The documentation caveat remains deliberate: source-level evidence is plan-only and runtime, trust-root, conditional-delete and live gates stay open.

GitHub Codex reviewed prior exact head 8bbf43ead63bdcfce8615a87c4038d84db30f6ed on 2026-11-03 with no major issues (review receipt comment); that review predates the context-scoped test-hook fix. Codex then completed review of exact current head 1ea35587f5df5fa6b7c1b5c34bc87689a8a02061 on 2026-11-03 with no findings (review status). The fresh exact-head Luna Max review and live-harness checklist review are queued and pending.

Verification

Go 1.27.3 was used with Go caches and temporary build files on /Volumes/worktree.

On current candidate 1ea35587f5df5fa6b7c1b5c34bc87689a8a02061:

• G02 race-enabled focused revocation tests, including full-path sync failure and exact DELETE counts — PASS (9.404s).
• G02 go vet ./... — PASS.
• G01 cmd/g01-live tagged tests — PASS on prior candidate 8bbf43e; this commit did not change the G01 module.
• G01 cmd/g01-live tagged vet — PASS on prior candidate 8bbf43e; this commit did not change the G01 module.
• Root go vet -tags=g01_live ./... — PASS.
• git diff --check — PASS.
• Root go test -tags=g01_live -count=1 -timeout=120s ./... — TIMED OUT in scripts.TestToolingTaggedPairFixturePartitionsRun. An isolated run of that test with a 180s limit also timed out while it invoked the offline partition matrix. These are inconclusive, not passes; no test processes remained afterward.
• The earlier G02 full suite and separate-process handoff fixtures passed on source commit 4f3d84f52402f21ec5b1031a19af92aaeb60b424; those results are retained at that immutable SHA.

The hosted Go check passed for current exact head 1ea35587f5df5fa6b7c1b5c34bc87689a8a02061 (run 41646883014). The prior candidate check also passed at 8bbf43ead63bdcfce8615a87c4038d84db30f6ed (run 41645907149). All token/provider interactions in these tests use synthetic fixtures. No real GitHub token was minted or revoked, and no provider, runner, Scale Set or host operation was performed.

Remaining G01 gates

This does not solve the management-token lifetime or non-atomic provider-read/handoff race. Authenticated provenance and trust-root custody, broker-only execution authority, trusted runtime/isolation and resource qualification, supported server-side conditional Scale Set deletion, and the separately authorized live Linux ARM64/JIT canary remain open. Issue #1 stays OPEN and Project #2 stays In progress.

Current candidate update — 2026-11-03 (a35220b089d3a3bd79ab1575620892f138739a42)

The latest offline fix closes the compound revocation-journal failure identified by the prior Luna Max review. Before read-token DELETE, the broker now syncs an account-ledger intent bound to phase, attempt inode and journal inode; it records confirmation only after DELETE succeeds and the per-attempt success record is durable. An unmatched intent blocks every later phase, including inspect and cleanup, before management-token issuance or handoff. A regression at prior head 1ea3558 reproduced the gap; the corrected full-path fixture now proves the later inspect is refused with zero token mints.

• G02 go test -count=1 -timeout=120s ./... — PASS (all packages).
• G02 go vet ./... — PASS.
• Focused G02 race tests for compound failure, confirmed-history replay and revocation-sync failure — PASS.
• git diff --check — PASS.
• Hosted Go checks for this exact head — pending.
• Fresh independent Luna Max review for this exact head — pending.
• GitHub Codex review was automatically triggered for this exact head and is running.

No live token, provider, runner, Scale Set, Docker or host operation occurred. Issue #1 remains OPEN and Project #2 remains In progress; production provenance, trust-root custody, broker-only execution, read-to-handoff race, management-token expiry/revocation, supported conditional Scale Set deletion, trusted runtime/isolation/resource qualification, live readiness and the separately authorized canary remain open.

Review status update — 2026-11-03

For exact head a35220b089d3a3bd79ab1575620892f138739a42, hosted Go checks passed (run 41652104987) and the GitHub Codex review completed with no findings. The independent Luna Max review was dispatched against this exact worktree; no final Orca result has arrived yet. PR remains open until that review is resolved and triaged. Issue #1 remains OPEN / Project #2 In progress; the live G01 gates listed above remain open.

Current candidate update — 2026-11-03 (efa05d8fb142a687fa58264ba119fef1558a33c7)

The independent Luna Max review at prior head a35220b089d3a3bd79ab1575620892f138739a42 found a P1: the account ledger recorded read-token revocation intent only after a usable response existed. If GitHub accepted the token POST and its response was lost, no token candidate or account barrier remained, so a later inspect could mint management authority. The RED regression reproduced that sequence on the prior head.

The fix syncs read_token_lifecycle_started immediately before the HTTP client dispatch. A lost response leaves the account-wide barrier pending. A failure before dispatch records read_token_request_not_dispatched; incomplete historical reusable-callee claims without lifecycle/no-dispatch proof fail closed. Correctly paired legacy revocation records remain compatible. The read-only mint helper now requires an explicit pre-request callback.

Validation on efa05d8

Go 1.27.3; GOCACHE, GOMODCACHE and TMPDIR were on /Volumes/worktree.

• RED on a35220b: accepted read-token POST with lost response, then inspect — FAIL as expected; no account intent, inspect completed and minted again.
• Focused lifecycle, no-dispatch, legacy/current replay, revocation failure, mint callback and scope tests — PASS (3.113s).
• G02 go test -race -count=1 -timeout=210s ./... — PASS (all packages; library 129.994s).
• G02 go vet ./... — PASS.
• gofmt -l on changed Go files and git diff --check — PASS.
• Hosted Go checks — PASS (run 41656408676).
• Fresh @codex review and independent Luna Max exact-head review — running/pending at this update.

No provider token, runner, Scale Set, Docker or host operation was used. GitHub issue/PR/Project metadata reads used gh. This PR does not close G01. Issue #1 remains OPEN and Project #2 In progress while production provenance/trust roots, management-token lifecycle, read-to-handoff race, conditional Scale Set deletion, trusted runtime/isolation/resource qualification, and separately authorized Linux ARM64/JIT canary evidence remain open.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-03T14:44:32.103819Z	efa05d8	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jjangg96]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

Reviewed commit: d8f387fdc7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jjangg96]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Can't wait for the next one!

Reviewed commit: b7ab4e7f0c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jjangg96]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: 7a5c6e2a57

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jjangg96]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Chef's kiss.

Reviewed commit: 8bbf43ead6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jjangg96]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Another round soon, please!

Reviewed commit: efa05d8fb1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[jjangg96]

Independent review triage — exact head efa05d8fb142a687fa58264ba119fef1558a33c7

• Scoped admission-ledger review: APPROVE for that scope, no actionable findings.
• Full offline delta review: APPROVE. Its P2 notes that the authenticated workflow-run provenance GET occurs before the fixed account admission ledger is opened, while the evidence prose says admission checks precede every API call and the lost-mint-response fixture does not count that GET. The reviewer found no installation-token mint bypass. This is a valuable, non-blocking follow-up under the repository review policy; tracked as issue #160, tied to this immutable head.
• P3 notes the event-bound comment does not describe the newer lifecycle/no-dispatch records. This is stale explanatory text with no identified behavior defect; triaged once as routine, non-blocking maintenance, with no fix or separate issue.
• Exact-head GitHub Codex review completed on this SHA without findings. PR Go checks passed; the inline review-comment endpoint is empty.

The P2 is not represented as fixed by this PR. No live provider, credentials, Scale Set, runner, Docker or host action was performed by these reviews.