feat: grok 1.0.30 epoch, sandbox log path, auth fail-fast (0.0.56)

[okisdev]

summary

• the grok lane works again on grok 1.0.30: grok 1.0.14 limited --sandbox strict writes to ~/.grok/sessions and moved sandbox-events.jsonl there, so every managed run since the 09-12 auto-update died at the handshake deadline as sandbox while /grok:setup reported ready; the companion now snapshots the sessions log
• a managed run whose stored OIDC token has expired now fails as auth in seconds: strict cannot refresh the six hour token anymore, so grok resubmitted the request without a credential up to 50 times until the 570s timeout; RUST_LOG now carries xai_grok_shell::session::acp_session::turn=warn and the first auth 401 retry: no credential was sent line stops the run with a remedy to run grok once outside the sandbox
• the grok companion gets a tested interval [1.0.14, 1.0.31) like the codex one (below it task, review, and stop gate fail as setup with a persisted record; at or past it setup reports not ready with a verification pass advised), job records carry grokVersion, the fusion breaker advisory names the installed build when it differs from the verified pin, and setup reports OrbStack's non-admin docker socket as a host advisory because upstream's runtime-socket deny list does not cover it
• docs, rules, skills, and pins move to the verified 1.0.30 contract as release 0.0.56; the reviewable logic lives in plugins/grok/scripts/lib/grok-exec.mjs, plugins/grok/scripts/grok-companion.mjs, plugins/grok/scripts/lib/render.mjs, and plugins/fusion/scripts/breaker-check.mjs, while plugins/fusion/rules-manifest.json is generated

test plan

already verified

• npm test -> 1153 tests, 1152 pass, 0 fail, 1 skipped
• live consult through the patched companion on grok 1.0.30 (node plugins/grok/scripts/grok-companion.mjs task --cwd <scratch dir> -- "Reply with exactly the single word PONG and nothing else.") -> done in 6s, the job record carries grokVersion: 1.0.30
• the same task with GROK_AUTH_PATH pointing at a fake expired credential in a directory strict can read but not write -> failure: auth after 38s instead of the 570s timeout
• node plugins/grok/scripts/grok-companion.mjs setup on this host -> compatibility: tested, host environment ready with the OrbStack socket advisory
• direct strict repro of the loop before the fix: 8 to 14 Re-authenticating after 401 (request carried no credential) retries per run; one unsandboxed grok -p refreshed auth.json, after which every strict run answered in 4 to 7s

reviewer should verify

• after the marketplace cache refreshes to 0.0.56, /grok:setup shows compatibility: tested and a /grok:task consult answers instead of dying at the handshake
• once the stored grok token expires (six hours after the last unsandboxed grok run), a /grok:task consult fails as auth within about a minute and prints the grok -p ok remedy

notes

• the fix reaches installed sessions only after the marketplace cache refreshes to 0.0.56; until then real dispatches keep failing at the handshake
• residual gaps: grok lane goes dark every six hours: strict cannot refresh the oidc token #56 (the lane still goes dark whenever nobody ran grok unsandboxed in the last six hours; needs an upstream fix or a companion side refresh) and strict does not deny orbstack's non-admin docker socket #57 (strict does not deny OrbStack's non-admin docker socket)