fix: private Grok worker temp, closed shared temp and worker-readable spills - #28

Open

apresmoi wants to merge 69 commits into

feat/grok-inference-grantsfrom

fix/grok-worker-tmp-spill

Commits on Sep 17, 2026

feat: give each Grok worker a private TMPDIR under its registered home
apresmoi
committed
024e102
feat: refuse Grok turns unless shared temp is closed to workers and the private temp is worker-only
apresmoi
committed
aa1aef0
build: rebuild native engine broker artifacts with the worker TMPDIR
apresmoi
committed
faae4cd
fix: write tool-output spills group-readable so the agent's own Grok worker can read them
apresmoi
committed
8d24c50
docs: document the Grok worker temp and spill provisioning contract
apresmoi
committed
45d9e41
fix: attest every registered Grok worker's private temp and close the temp attestation test gaps
apresmoi
committed
7439edb
fix: pin the tool-output spill directory and publish spills by rename into the verified directory
apresmoi
committed
a2ba04b
fix: refuse non-canonical Grok worker registration paths and truncated worker environment paths
apresmoi
committed
4aef65c
build: rebuild native engine broker artifacts with canonical registration paths
apresmoi
committed
4c761c8
docs: record sibling temp attestation, spill directory pinning and canonical registration paths
apresmoi
committed
4e874ad
fix: refuse Grok worker deny paths bubblewrap cannot materialize as the worker uid
apresmoi
committed
92fb1ca
fix: let the Grok broker projection mask the wake-acceptance store through a covering directory
apresmoi
committed
8c7e309
fix: accept the contracted traverse-only runtime home for brokered Grok agents
apresmoi
committed
089c3f8
fix: create every runtime-home directory private so a traversable Grok home exposes only tool-output
apresmoi
committed
277ea26
docs: state the traverse-only Grok runtime home rule and the private subdirectory rule
apresmoi
committed
bcd2f8e
fix: name the mounted tools in the agent identity envelope
apresmoi
committed
d485784
build: stage the packaged Linux engine broker on every packing host
apresmoi
committed
0c16fc5
fix: refuse broker proxy policy misses non-retryably with a named reason
apresmoi
committed
1af01fd
fix: keep the Grok session-title sink on its transient refusal shape
apresmoi
committed
7b9a92c
test: keep the grant-path title sink refusal transient
apresmoi
committed
1a6ee5d
fix: lead an inbox turn with each delivery's own text and keep the accounting after it
apresmoi
committed
b54f66f
fix: name a failed brokered worker's own reason instead of its exit code
apresmoi
committed
8496d44
fix: stop naming a healthy turn's own two proxy requests as refusals
apresmoi
committed
bac2d12
test: pin the no-active-turn refusal to its non-retryable shape
apresmoi
committed
081b3ce
fix: state the Grok use_tool prefix rule once, from the worker contract both texts render
apresmoi
committed
37363c3
fix: name the prefixed Grok tool form as the only valid one and add no third search_tool voice
apresmoi
committed
cb7a745
feat: record each brokered request's tool-call names in the per-request ledger
apresmoi
committed
1c74e71
test: split the identity-envelope tests into their own file under the line limit
apresmoi
committed
d8a67dc
fix: prefix the inbox prompt's oversized-payload branch for Grok too
apresmoi
committed
964dda3
fix: forward the MCP session and protocol headers and the GET/DELETE routes through the broker facade
apresmoi
committed
23b28e9
docs: record the broker MCP facade's closed header allowlist and supported methods
apresmoi
committed
8d5c26c
fix: name the transport send tool the way Grok can call it
apresmoi
committed
a43d62c
test: share one facade across the broker MCP facade tests and cover revoke and shutdown teardown
apresmoi
committed
9d773ae
fix: name the underlying fault beside the proxy's broker_unavailable log line
apresmoi
committed
73cc6b6
fix: name one level of a broker fault's own cause so a failed provider fetch says which fault it was
apresmoi
committed
16c1224
fix: escape the flatten ranges and the test's control byte so no source carries a raw control byte
apresmoi
committed
f3d4b2b
fix: wake the MCP facade's backpressure await on a hang-up or abort so a stalled tunnel cannot park a turn
apresmoi
committed
6a4fa63
fix: refuse a fenced credential realm as a named non-retryable auth_stale on the turn path
apresmoi
committed
64a30bb
docs: keep the session-title sink's own paragraph intact in the runtime guide
apresmoi
committed
8ac45f4
fix: let a usage decoder fault fall through to the estimate instead of failing a paid request
apresmoi
committed
a509277
fix: decode a failed worker's last words as text and keep both ends of the diagnostic window
apresmoi
committed
20ae57b
fix: keep both ends of the launcher's diagnostic window and scrub credentials split by its cut
apresmoi
committed
3f063c6

Commits on Sep 18, 2026