security: migrate Codex fleet scanning to persistent serialized auth

[jason-allen-oneal]

Problem

The fleet-wide Codex Security caller design copies one rotating ChatGPT OAuth session into multiple disposable GitHub-hosted runners. Concurrent refreshes invalidate one another, and refreshed state is discarded after each run.

Required architecture

• Run scans serially from one trusted persistent execution environment.
• Keep CODEX_HOME on encrypted persistent storage with least-privilege filesystem permissions.
• Use a dedicated self-hosted runner or a service API credential.
• Never publish refreshed authentication through artifacts or Actions caches.
• Preserve repository-native CodeQL, Dependabot, Scorecard, and CI coverage.

Acceptance criteria

• Trusted runner or service credential is provisioned through a host-owned secure flow.
• One central fleet workflow scans the approved repository inventory serially.
• Authentication refresh state survives scheduled runs without copying it to repositories.
• Concurrency prevents overlapping scanner use.
• Results are private, encrypted, and retained under documented policy.
• A complete canary scan succeeds before fleet scheduling is enabled.
• Obsolete repository-local OAuth secrets are removed after migration.

Current blocker

Neither configured GitHub identity can administer organization runners, and a new credential cannot be collected through chat. Provisioning therefore requires an organization owner using GitHub's secure runner setup or a separately managed API credential.

[jason-allen-oneal]

Live migration checkpoint — 2026-08-30

Repository cleanup is complete: all nine disposable-runner caller workflows were removed, and the hosted schedule in odinn-maintainer was paused.

The remaining control-plane gate was reproduced locally:

• codex login status reports a stored ChatGPT session.
• A real model request fails with refresh_token_reused.
• No connected Computer Control node is available for transcript-safe browser reauthentication.
• The configured GitHub identities cannot administer organization runners.

Therefore the replacement cannot be activated safely from this session. The next authorized operator action is one of:

1. connect a trusted Computer Control node and complete browser sign-in without exposing a device code; or
2. provision a dedicated service API credential through the host-owned secret store and accept API billing; then
3. register a trusted persistent runner with organization-owner privileges.

Until then, repository-native CI, CodeQL, Dependabot, Scorecard, secret scanning, and push protection remain the active security controls. No OAuth material is stored in Actions caches or artifacts.

[jason-allen-oneal]

Dependency risk checkpoint — 2026-08-30

Dependabot alert 3 (GHSA-jmr9-qjv8-65gv) remains upstream-unpatchable: extract-zip 2.0.1 is still the latest release and Codex Security 0.1.24 still depends on it. Organization code search confirms no repository calls either reusable Codex Security workflow; both control-plane workflows are workflow_call-only and therefore inert.

The alert is accepted temporarily as tolerable risk while this issue remains open. It must be reopened before any scanner caller or schedule is enabled, or reviewed by 2026-10-31, whichever occurs first. Activation acceptance criteria now also require a patched extract path, a safe replacement, or a bounded proof that archive extraction is unreachable for the approved scan mode.

[jason-allen-oneal]

2026-08-30 final verification

Repository cleanup is complete: obsolete per-repository OAuth callers are gone, the old maintainer workflow is disabled, and native CI, CodeQL where configured, Dependabot, Scorecard, secret scanning, and push protection remain active.

The replacement control plane is still blocked on infrastructure authority:

• the prior shared OAuth refresh state is invalid and cannot be reused;
• the current OpenClaw Gateway reports zero paired Computer Control nodes;
• the protected secret store has no API credential;
• the configured GitHub identities cannot administer organization runners.

The next authorized operator action is either:

1. provision a trusted organization self-hosted runner with encrypted persistent CODEX_HOME and complete authentication outside chat; or
2. explicitly approve paid OpenAI API usage and enter the key through OpenClaw's protected secret prompt for api.openai.com.

Do not restore repository-local OAuth secrets or concurrent disposable-runner scanning.