feat(identity): Order C codex askpass worktree wiring #12

Merged

pdurlej merged 5 commits from codex/identity-wiring/order-c-askpass into main

2026-05-02 00:42:39 +02:00

codex commented

2026-05-02 00:10:50 +02:00

Collaborator

Summary

Implements Order C codex commit/push identity wiring: a runtime askpass-codex.sh, worktree-local git config setup/verify commands, and an identity-doctor codex askpass check. The askpass wrapper contains no token literal, validates Forgejo prompts, prints codex for username prompts, and resolves the codex Forgejo PAT at invocation time.

Spec conflict resolution

Order C's original master prompt specified Bitwarden item codex field PAT. The active PLATFORM_CHARTER §5 and local canary-env define Forgejo service-account PATs as Infisical-primary machine credentials under /home-platform/forgejo_accounts/<email>, with Bitwarden reserved for personal/bootstrap credentials. This PR preserves the Order C exported API names, askpass path, worktree-local git config behavior, and verification surface, but resolves the Codex PAT through the Infisical-backed runtime resolver to comply with the current charter.

Tests

Focused test excerpt:

platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_happy_path PASSED
platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_infisical_unavailable PASSED
platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_secret_missing PASSED
platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_secret_empty PASSED
platformctl/tests/test_codex_askpass.py::test_setup_worktree_git_config_creates_askpass_and_sets_keys PASSED
platformctl/tests/test_codex_askpass.py::test_setup_worktree_git_config_idempotent_and_repairs_loose_wrapper PASSED
platformctl/tests/test_codex_askpass.py::test_verify_codex_identity_passes_when_correct PASSED
platformctl/tests/test_codex_askpass.py::test_verify_codex_identity_fails_on_loose_mode_or_wrong_path PASSED
platformctl/tests/test_codex_askpass.py::test_askpass_script_username_prompt_expected_host PASSED
platformctl/tests/test_codex_askpass.py::test_askpass_script_password_prompt_with_fake_infisical_no_token_on_stderr PASSED
platformctl/tests/test_codex_askpass.py::test_askpass_script_rejects_unexpected_or_wrong_host_prompt PASSED
============================== 11 passed in 1.79s ==============================

Full suite:

python3 -m pytest platformctl/tests/ -v
============================= 138 passed in 7.04s ==============================

Manual verification:

platformctl identity codex verify "$PWD"
PASS worktreeConfig: got 'true', expected 'true'
PASS user.name: got 'codex', expected 'codex'
PASS user.email: got 'codex@noreply.git.pdurlej.com', expected 'codex@noreply.git.pdurlej.com'
PASS core.askPass: got '/Users/pd/.platformctl-runtime/git/askpass-codex.sh', expected '/Users/pd/.platformctl-runtime/git/askpass-codex.sh'
PASS remote.origin.url: got 'https://codex@git.pdurlej.com/pdurlej/platform.git', expected 'https://codex@git.pdurlej.com/pdurlej/platform.git'
PASS credential.helper: got [''], expected ['']
PASS askpass.exists: /Users/pd/.platformctl-runtime/git/askpass-codex.sh
PASS askpass.mode: got 0o700, expected 0o700
PASS

platformctl identity doctor codex --repo-root "$PWD" --expected-email codex@noreply.git.pdurlej.com --skip forgejo --skip infisical --skip review --skip mcp
identity doctor — actor=codex
  ✓ git: name=codex email=codex@noreply.git.pdurlej.com
  ✓ git:codex-askpass: /Users/pd/.platformctl-runtime/git/askpass-codex.sh mode=0o700
=> PASS (partial stub; not approval-grade — see charter §3)

Adds the Charter §4 Codex commit/push identity sub-rule.

Operator checklist

Operator verifies post-merge that subsequent Codex PR pushes as codex.

Base note

Local origin/main still pointed at PR #9 while the handoff said PR #10/#11 were merged. This branch includes the Order D reviewer-context commits and the Order C master-prompt commit to match the intended post-merge context before the Order C implementation commit.

## Summary Implements Order C codex commit/push identity wiring: a runtime `askpass-codex.sh`, worktree-local git config setup/verify commands, and an identity-doctor codex askpass check. The askpass wrapper contains no token literal, validates Forgejo prompts, prints `codex` for username prompts, and resolves the codex Forgejo PAT at invocation time. ## Spec conflict resolution Order C's original master prompt specified Bitwarden item `codex` field `PAT`. The active PLATFORM_CHARTER §5 and local canary-env define Forgejo service-account PATs as Infisical-primary machine credentials under `/home-platform/forgejo_accounts/<email>`, with Bitwarden reserved for personal/bootstrap credentials. This PR preserves the Order C exported API names, askpass path, worktree-local git config behavior, and verification surface, but resolves the Codex PAT through the Infisical-backed runtime resolver to comply with the current charter. ## Tests Focused test excerpt: ```text platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_happy_path PASSED platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_infisical_unavailable PASSED platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_secret_missing PASSED platformctl/tests/test_codex_askpass.py::test_resolve_codex_pat_secret_empty PASSED platformctl/tests/test_codex_askpass.py::test_setup_worktree_git_config_creates_askpass_and_sets_keys PASSED platformctl/tests/test_codex_askpass.py::test_setup_worktree_git_config_idempotent_and_repairs_loose_wrapper PASSED platformctl/tests/test_codex_askpass.py::test_verify_codex_identity_passes_when_correct PASSED platformctl/tests/test_codex_askpass.py::test_verify_codex_identity_fails_on_loose_mode_or_wrong_path PASSED platformctl/tests/test_codex_askpass.py::test_askpass_script_username_prompt_expected_host PASSED platformctl/tests/test_codex_askpass.py::test_askpass_script_password_prompt_with_fake_infisical_no_token_on_stderr PASSED platformctl/tests/test_codex_askpass.py::test_askpass_script_rejects_unexpected_or_wrong_host_prompt PASSED ============================== 11 passed in 1.79s ============================== ``` Full suite: ```text python3 -m pytest platformctl/tests/ -v ============================= 138 passed in 7.04s ============================== ``` Manual verification: ```text platformctl identity codex verify "$PWD" PASS worktreeConfig: got 'true', expected 'true' PASS user.name: got 'codex', expected 'codex' PASS user.email: got 'codex@noreply.git.pdurlej.com', expected 'codex@noreply.git.pdurlej.com' PASS core.askPass: got '/Users/pd/.platformctl-runtime/git/askpass-codex.sh', expected '/Users/pd/.platformctl-runtime/git/askpass-codex.sh' PASS remote.origin.url: got 'https://codex@git.pdurlej.com/pdurlej/platform.git', expected 'https://codex@git.pdurlej.com/pdurlej/platform.git' PASS credential.helper: got [''], expected [''] PASS askpass.exists: /Users/pd/.platformctl-runtime/git/askpass-codex.sh PASS askpass.mode: got 0o700, expected 0o700 PASS platformctl identity doctor codex --repo-root "$PWD" --expected-email codex@noreply.git.pdurlej.com --skip forgejo --skip infisical --skip review --skip mcp identity doctor — actor=codex ✓ git: name=codex email=codex@noreply.git.pdurlej.com ✓ git:codex-askpass: /Users/pd/.platformctl-runtime/git/askpass-codex.sh mode=0o700 => PASS (partial stub; not approval-grade — see charter §3) ``` Adds the Charter §4 Codex commit/push identity sub-rule. ## Operator checklist - [ ] Operator verifies post-merge that subsequent Codex PR pushes as `codex`. ## Base note Local `origin/main` still pointed at PR #9 while the handoff said PR #10/#11 were merged. This branch includes the Order D reviewer-context commits and the Order C master-prompt commit to match the intended post-merge context before the Order C implementation commit.

codex added 5 commits

2026-05-02 00:10:50 +02:00

feat(review): Order D — PLATFORM_CONTEXT for reviewer noise floor + charter auto-loop policy bb37f67bb7

## Summary

Two coupled changes addressing operator observation: "reviewerzy szaleją bo
każdy chce się wykazać" (reviewers pad output to look thorough).

### 1. PLATFORM_CONTEXT prepended to every reviewer's system prompt

`control-plane/platformctl/tools/providers/_base.py`: new `_PLATFORM_CONTEXT`
constant prepended to all 6 reviewers' system prompts (3 tech + 3 product, all
glm/codex/claude families). Frames the operating environment:

- single-operator homelab (NOT enterprise SaaS)
- ADHD operator, ≤300 LOC norm, sacred paths
- "fix existing bug > elegance refactor"
- "one sharp finding > five vague ones"
- orchestrator role rotates per PR (not always claude)
- mobile approval workflow

Without this frame, reviewers padded with enterprise patterns and 5+ low-severity
nits per PR. PR #9's 3+3 review showed the pattern clearly.

### 2. Charter §3 sub-rule: Reviewer noise floor + autonomous fix-loop policy

`PLATFORM_CHARTER.md` adds one sub-rule covering both:
- the PLATFORM_CONTEXT noise-floor convention
- autonomous fix-loop policy (max 3 attempts before operator gate)

Auto-loop implementation (Order E target) deferred — this PR adds policy text
+ open loops; auto-amend/auto-merge code lands later.

### 3. Open loops added (state/STATUS_NOW.md)

- `iterate-platform-context-for-reviewers` — revisit PLATFORM_CONTEXT after
  N≥10 reviewed PRs to incorporate emergent patterns
- `autonomous-fix-loop-impl` — Order E target, deadline 2026-06-01

## Tests: 127/127 green (was 124, +3 new)

- `test_system_prompt_includes_platform_context_for_all_reviewers`
- `test_platform_context_appears_before_role_lens_and_output_schema`
- `test_platform_context_does_not_leak_secrets_or_paths`

## Test plan

- [x] 127 unit tests
- [ ] Recursive meta-test: this very PR will fire 3+3 review with the new
      PLATFORM_CONTEXT injected. Operator + orchestrator observe whether
      noise-floor improvement is visible vs PR #9's review pattern
- [ ] After merge: Order C (Codex implements askpass) lands separately

## Linkage

- Successor to merged PR #9 (per-actor + decision comment infrastructure)
- Precursor to Order C (Codex git askpass) — independent track, parallel
- Precursor to A1 (fix_patch.ops[] schema) — A1 reviewers will benefit from
  reduced noise floor

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Oracle GPT-5.5 Pro <noreply@anthropic.com>

fix(stewardship): sanitize STATUS_NOW credential topology + Charter §5 sub-rule ed81012053

Addresses canary δ on PR #10 product-gpt high-risk:
> "Remove credential topology from STATUS_NOW before merge — state/STATUS_NOW.md
> adds Bitwarden item IDs, Infisical machine identity IDs, client IDs, workspace
> IDs, wrapper paths, and local Oracle/browser profile paths..."

## Changes

1. **state/STATUS_NOW.md**: stripped all UUIDs (BW item IDs, machine identity
   IDs, Client IDs, workspace IDs) and direct path-to-config references. Replaced
   with semantic descriptions ("Forgejo service accounts wired", "Infisical
   primary credential source") + reference to `~/.platformctl-runtime/state-machine-local.md`
   for the actual operational inventory.

2. **PLATFORM_CHARTER.md §5**: new sub-rule "Secret stewardship — primary vs
   personal" codifying operator's pattern:
   - Infisical = primary for all machine credentials (API keys, PATs, tokens)
   - BW + macOS Keychain = rare, only operator's personal credentials
   - One BW item kept routinely: Infisical Client Secret (bootstrap pair)
   - Tracked-state hygiene: no UUIDs in `state/` files (machine-local lives outside repo)

3. **Closes open loop `infisical-pat-migration`** (Order F target became operator's
   live pivot during canary δ — done).

4. **Adds open loop `single-comment-regression`** (Order G target) — canary δ
   emitted only 1 comment via legacy path; PR #9's per-actor + decision design
   silently regressed.

## Linkage

- Amends PR #10 (Order D PLATFORM_CONTEXT)
- New machine-local file `~/.platformctl-runtime/state-machine-local.md` (mode 0600,
  gitignored) holds the actual UUIDs that were sanitized out

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(status): close single-comment-regression — was Order D stale-base, not a regression 4190cbfded

Canary δ on PR #10 emitted 1 comment instead of 4. Initial diagnosis: bug in
run_review.py main(). Actual root cause: Order D branch was created from local
main BEFORE pulling latest, so it didn't have PR #9 merge commits with the
per-actor + decision functions. Rebase fixed it; tests still pass (127); no
code change needed. Updated STATUS_NOW open loops to reflect.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs(prompts): add Order C master prompt for Codex (Oracle-validated) 212340063b

Self-contained delegation brief for Codex GPT-5.5 implementing Order C —
git askpass + commit/push identity wiring per charter §4.

Reviewed and rewritten by Oracle (gpt-5.5-pro) before delegation. Key
corrections from Oracle vs initial draft:

- bootstrap rule: Codex creates askpass locally and pushes via codex
  (not pdurlej HTTPS fallback) — escalate if it fails
- worktree-local config requires extensions.worktreeConfig + --worktree
  (not just absence of --global)
- credential.helper reset is part of identity boundary, not just askPass
- ensure_codex_askpass() function explicitly required in API
- askpass receives prompt as argv (not stdin) — verification corrected
- additional edge cases: empty PAT field, wrong-host prompt, existing
  wrapper repair, runtime override for tests, atomic concurrent setup

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Oracle GPT-5.5 Pro <noreply@anthropic.com>

feat(identity): wire codex askpass worktree setup 7b546b9d4c