[nick-potts]

Companion to SL9b (Sealed values in GitHub builds). The runner holds its own Build Grant key, so Cloud never sees the grant secret.

What changes

• prepare.sh generates an ed25519 key with node:crypto before the check-in. It writes the 32-byte seed 0600 to the work dir and sends {"holder":"<64 hex>"} as the check-in body.
• A holder mint answers machine instead of grant. grant.js assembles ployzgrant1: + base64url(machine ‖ seed) in Node and prints ::add-mask:: for it before anything else runs. A response with grant (an older Machine or Cloud) still works.
• build.sh reads the grant from the work dir. An EXIT/INT/TERM trap sends TERM to ployz build, waits for it, and only then removes the work dir. The always() cleanup in action.yml stays.
• The runner now needs Node.js on PATH. GitHub-hosted runners have it. A runner without it fails with a clear error.

Ship order

Cloud and the daemon ship first, then this tag moves v1. Plain builds work in every mix. Do not merge or tag until the core PR is deployed.

Tests

bash test.sh and shellcheck *.sh pass on Ubuntu 24.04 (jq 1.7, Node 18). New cases:

• RFC 8032 test 1 seed gives the expected holder through the Node import path.
• Machine 32×0x01 with that seed assembles the contract's fixture grant, and it is masked.
• A malformed machine is refused.
• The full holder flow builds with the assembled grant, masked on the first line after the OIDC token.
• The legacy grant response still builds.
• The key file is 0600, and the check-in body carries its holder.
• A cancelled build is stopped within 5s. The key is still present while it stops, and the work dir is gone after.

Removing the trap's kill or its wait each fails a test.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 10f4b297-eb85-4d8f-a272-472a8fafba44

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-27T02:36:13.075143Z	35e2602	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.