codex install: failed install can strand a live credential when Codex concurrently rewrites config.toml

[jarodtaylor]

Source: U24 (#24) ce-code-review — cross-model Codex adversarial peer, P1@conf75. Disposition: DEFER to the decision-#16 config-write-robustness cluster — but this one warrants a CEO scope call (see options), because it works against #24's own acceptance criterion "a failed install leaves no live credential behind."

Mechanism (verified against undo.ts)

1. Fresh install mints token T, writes config.toml (write a succeeds, journaled).
2. A concurrent Codex process rewrites config.toml for its own reasons (settings/trust hashes), preserving our entry — this changes the whole-file hash.
3. A later install write (b hooks.json / c AGENTS.md) fails (symlink/permission/corruption).
4. Rollback calls the journal undo, whose identity check refuses on the diverged file — src/configwrite/undo.ts:117 if (currentHash !== entry.postHash) throw … refusing to clobber a later write. rollback catches+logs it best-effort, so our entry (with T) survives.
5. U8's second backstop (revokeMintedToken deleting codex.token) was removed by U8 follow-up: single-source the Codex credential — gate reads the token from config.toml, retire codex.token #24, so nothing else neutralizes T. readCodexToken still extracts T → the gate keeps accepting a credential from a failed install.

The non-concurrent case is safe and tested (rollback undoes the config write when it is NOT diverged). The gap is specifically failed-install × concurrent-Codex-rewrite.

Why deferred (reachability)

Triple coincidence in a ~ms window: fresh mint + concurrent Codex rewrite between writes a and b/c + a b/c write fault. Manual single-user CLI, pre-U15 no always-on server; a re-run of install (idempotent) or uninstall (targeted removal) cleans it. Same class as the documented first-write journal window already deferred to #16 (src/install/codex.ts:210-219). The in-process Opus adversarial reviewer put it below the merge bar.

Scope options (CEO call — Jarod)

• A. Defer to the Capture: cold-start tail reads a whole file in one allocation #16 cluster (this issue as-is). Cleanest; keeps the unit subtractive.
• B. Harden now, small. It does not require reintroducing the deleted apparatus. One boolean mintedFresh = extractCodexToken(existingConfig) === null, and in the rollback catch, when mintedFresh, do a targeted removeKeysIfPresent('mcp_servers.agent-os') gated on the embedded token still equaling T (compare-and-remove) — reusing the uninstaller's own divergence-robust helper. Larger than one line (fully hardening its own failure path overlaps the Capture: cold-start tail reads a whole file in one allocation #16 engine fix), smaller than "re-add provenance."

Not a merge blocker for #24 — but flag for Jarod's decision on A vs B.

[jarodtaylor]

Dispositioned by Jarod (2026-07-20): DEFER — option A. Captured here and flagged for the decision-#16 config-write-robustness cluster (siblings: #11 undo-record-lost-on-crash, #10 concurrent-merges-lose-updates — same "rollback/undo can't faithfully reverse a diverged live-state file" family).

Why A over B: the edge is a narrow concurrent-manual-CLI TOCTOU (fresh mint + a concurrent Codex config rewrite in a ~ms window + a failed b/c write), pre-U15 with no always-on server. The full fix belongs at the engine level (journal-before-publish, or committed-failure metadata the caller can act on — the same fix #11 wants), not as installer-local provenance that would re-grow the machinery U24 deleted. Keeping U24 subtractive.

Promotion trigger: when the decision-#16 config-write robustness cluster is worked (the engine-level rollback/journal hardening), fold this credential-bearing case in — a failed-install rollback that can't reverse a diverged config.toml is the same defect as #11, just with a credential at stake. If an always-on server (U15) ships before that, re-rank: a stranded credential matters more once a long-lived gate is reading the file.

Interim safety net already in place: the uninstaller's targeted removal (not whole-file undo) revokes cleanly regardless of divergence, and a re-run install/uninstall neutralizes a stranded token.