Skip to content

Bind selected provider launches to closed lifecycle custody - #776

Merged
Meta-Develop merged 1 commit into
mainfrom
codex/secret-lifecycle-dispatch-20261029
Oct 29, 2026
Merged

Meta-Develop merged 1 commit into
mainfrom
codex/secret-lifecycle-dispatch-20261029

Conversation

@Meta-Develop

Copy link
Copy Markdown
Owner

Stacked on #771 (selected-account lease custody); GitHub retargets this PR to main once #771 merges.

First slice of #725.

  • Bind selected-account launches to one-shot run/operation lifecycle guards and the exact account incarnation.
  • Check expiry and pre-spawn revocation at admission and at spawn, and expose only reference-level lifecycle evidence.
  • Declare inherited credential environment inputs (including Cursor's API key) while keeping adapter-specific clearing and home confinement.
  • Finalize only on refusal, spawn failure or confirmed child exit or cancellation; custody is retained when the exit is unknown.

Tests use synthetic child and store fixtures only. Root executor integration and coordinated rotation/revocation follow in later changes.

Validation: formatting, 17 exact library tests, the launch-contract tests and the Grok and Cursor launch regressions passed on Linux; the desktop tests and platform suites run in CI.

Refs #725.

Stacked on #771 (selected-account lease custody); GitHub retargets this PR to main once #771 merges.

First slice of #725.

- Bind selected-account launches to one-shot run/operation lifecycle guards and the exact account incarnation.
- Check expiry and pre-spawn revocation at admission and at spawn, and expose only reference-level lifecycle evidence.
- Declare inherited credential environment inputs (including Cursor's API key) while keeping adapter-specific clearing and home confinement.
- Finalize only on refusal, spawn failure or confirmed child exit or cancellation; custody is retained when the exit is unknown.

Tests use synthetic child and store fixtures only. Root executor integration and coordinated rotation/revocation follow in later changes.

Validation: formatting, 17 exact library tests, the launch-contract tests and the Grok and Cursor launch regressions passed on Linux; the desktop tests and platform suites run in CI.
@Meta-Develop
Meta-Develop changed the base branch from codex/selected-use-lease-custody-20261029 to main October 29, 2026 18:12
@Meta-Develop
Meta-Develop merged commit d526c18 into main Oct 29, 2026
3 of 16 checks passed
@Meta-Develop
Meta-Develop deleted the codex/secret-lifecycle-dispatch-20261029 branch October 29, 2026 20:59
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant