codex install: reinstall TOCTOU can resurrect a just-rotated credential (concurrent, single-user-immaterial)

[jarodtaylor]

Source: U24 (#24) ce-code-review — cross-model Codex adversarial peer, P1@conf75. Disposition: DEFER to the #28/#29 concurrent-config-write cluster (below the merge bar; see reachability).

Mechanism (real)

installCodex reads config.toml twice with no lock between:

• src/install/codex.ts:220 — const existingConfig = readToml(configTomlPath(home)) (pre-flight), then :228 const token = extractCodexToken(existingConfig) ?? randomUUID() captures token A.
• The authoritative write re-reads the file inside mergeConfig (src/configwrite/engine.ts:~229) but applies a static patch built from A, and replaceSubtrees:['mcp_servers.agent-os'] replaces the whole entry.

If the embedded credential changes A→B between those two reads, the write puts A back. Since the gate reads config.toml live, revoked A then authenticates while B is rejected.

Why deferred (reachability)

• No rotation daemon exists — only installCodex writes our token, and it reuses rather than rotates. Getting from A to B requires a concurrent uninstall+reinstall cycle interleaving a running install's ~ms window: concurrent invocation of a manual, single-user CLI.
• Pre-U15 there is no always-on server / no concurrent path.
• This is the same TOCTOU class DECISIONS configwrite: NOOP sentinel misses missing-LEAF removals — parent-exists/key-absent still rewrites foreign-formatted configs #29 already ruled operationally immaterial and configwrite: backup is an independent re-read of the target — foreign write in the read→backup→rename window is silently lost #28 tracks (installer's second read now sits in that pre-existing gap).
• Four independent in-process reviewers (adversarial, project-standards, testing, agent-native) classified it as a below-bar residual.

If we ever fix it

Derive+reuse the token inside mergeConfig's callback form from that callback's current value (eliminating the separate snapshot), or add compare-and-swap/lock on publish. Both belong with the engine-level #28 fix, not a point patch here.

Not a blocker for #24 — normal single-user macOS flow never hits it.