feat(people): add provider presets and gate Codex enrollment

[salmonumbrella]

People inference gains OpenAI, OpenRouter, and Venice presets with fixed endpoints, write-only key entry, and explicit model and privacy choices. Setup no longer treats an OpenAI key as a request to enable people inference. Checks, disclosure consent, and provider selection remain separate steps.

The Web UI and CLI support preset setup; the TUI manages existing profiles. A profile remains visible and removable if saving its key fails. Credential changes revoke both saved and running consent while a daemon restart is pending. Browser requests cannot select daemon environment variables as credentials.

Codex enrollment and transport code are included behind a disabled release gate. Sign-in, model discovery, and inference remain unavailable until a build is certified; sign-in returns HTTP 503 before changing credentials or consent. Linux CI builds include the adjacent static bridge and its linked checksum. Other distribution paths and real-artifact certification still need work before enabling Codex. Review the Codex credential lifecycle and process isolation separately from the usable HTTP presets.

Refs #917

[roborev-ci]

roborev: Combined Review (84c7900)

Verdict: Changes require fixes for 2 findings.

High

• internal/peoplesweep/codex_isolation_release.go:3-6; cmd/msgvault/cmd/person_provider_codex_enroll.go:169-190: Codex enrollment proceeds through profile creation, synthetic check, consent, and selection even though the production isolation gate has an empty attestation registry, so the advertised end-to-end flow cannot complete and may leave saved profile state. Keep the fail-closed gate, but hide or explicitly gate check, consent, and selection until verified release attestation ships, or clearly stop enrollment after saving authentication/profile state.

  Reported by: codex

Medium

• internal/api/people_codex_login.go:58-80; internal/api/settings_people_codex_login.go:229-294: A completed login session remains usable after another owner starts a new login. Because the shared people-codex auth file is replaced, stale /models and /profile requests can use the new account's credentials and create a profile under the wrong account. Invalidate completed drafts when shared authentication is replaced, or record an auth generation/account identity per session and reject stale model/profile operations.

  Reported by: codex

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 19m1s

[roborev-ci]

roborev: Combined Review (e87cb54)

Verdict: Changes require fixes for 2 findings.

Medium

• internal/personenrollment/service.go:224-231: Removing a stored-key preset without a credential fails because RemoveProfile always calls PreflightDelete, which returns ErrCredentialNotFound; profiles created before their key cannot be removed through the API, Web UI, or CLI. Treat an absent credential as already deleted during profile removal, and only preflight and securely retire the credential when one exists.

  Reported by: codex

• internal/api/settings_people_inference.go:486-534: Credential PUT and DELETE revoke consent and invalidate the successful check before the revision-guarded credential mutation. A stale request or transient SaveIfRevision/DeleteIfRevision failure can return an error while leaving the current credential intact but its active authority revoked. Make the revision-guarded credential update/removal and authority invalidation atomic or rollbackable so failed revision checks do not mutate consent or check state.

  Reported by: codex

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 18m13s

[roborev-ci]

roborev: Combined Review (414cbb0)

Verdict: Changes require fixes for 2 findings.

High

• internal/peoplesweep/codex_isolation_release.go:6: Codex enrollment always proceeds to profile checking, but the production isolation gate has no released attestations. Profiles are saved, then checks cannot succeed, so users cannot consent to or select a Codex profile. Release a verified attestation and bridge before exposing this workflow, or keep enrollment unavailable until the runtime gate is released.

  Reported by: codex

Medium

• web/tests/people-inference-viewport.config.ts:11: The viewport test server command uses vite .. and --config people-inference-vite.config.ts from the web directory, while the fixture and config are under web/tests. The configured URL therefore does not target the intended test app. Use the correct working directory and paths, such as vite . --config tests/people-inference-vite.config.ts, or set the web server cwd to tests.

  Reported by: codex

---

Reviewers: 2 done | Synthesis: codex, 8s | Total: 20m27s

[roborev-ci]

roborev: Combined Review (f32e361)

Verdict: Changes require fixes for 1 finding.

High

• internal/api/people_codex_login.go:64: Only pending sessions block a new login. After session A completes, session B can start and replace the shared Codex authentication while A remains usable; A's model-list and profile-create handlers can then operate under B's account. Reject any unconsumed session globally, or bind completed sessions to an authentication revision/account identity and verify it before model listing or profile creation. Add a regression test covering a completed session followed by a second-owner login.

  Reported by: codex

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 22m37s

[roborev-ci]

roborev: Combined Review (ec9ba5b)

Verdict: Changes require fixes for 2 findings.

High

• internal/api/settings_people_inference.go:672: The Codex check path uses NewReleasedCodexIsolationGate, but releasedCodexAttestations is empty, so every Codex profile is rejected as unreleased before checking, consenting, or selecting it. The Web UI and CLI still expose Codex enrollment as usable, leaving users with an unusable saved profile. Keep Codex profiles hidden or explicitly enrollment-only until a reviewed inference attestation is registered, or populate the production release registry only after the required containment and inference probes pass.

  Reported by: codex

• internal/peoplesweep/codex_process.go:229-234; internal/peoplesweep/codex_process_linux.go:140: The production launcher stages auth.json containing OAuth tokens under /work/.codex, then bind-mounts the entire work directory into Codex. Core command/exec remains available under the read-only sandbox, so prompt-injected archive content can cause the model to read /work/.codex/auth.json and return the access or refresh token in structured output. Keep token-bearing files outside every model/tool-readable path. Hide .codex/auth.json from command/exec through the sandbox boundary or use a separate credential broker/request-scoped authentication mechanism, and add an integration test with a synthetic staged auth file.

  Reported by: codex (security)

---

Reviewers: 2 done | Synthesis: codex, 9s | Total: 22m19s

[roborev-ci]

roborev: Combined Review (c42ecf1)

Verdict: Changes require fixes for 2 findings.

Medium

• web/src/lib/components/settings/PeopleInferenceSettings.svelte:90: The web UI always creates profiles using stored credentials. On Windows and other unsupported platforms, profile creation succeeds but saving the API key fails because the credential store is unavailable, leaving an unusable profile without a supported enrollment path.

  Fix: Expose credential-store capability to the UI and reject or avoid stored-key enrollment before creating the profile, or add environment-credential enrollment for unsupported platforms. Roll back the profile if key storage fails.

• Dockerfile:45: The Docker Linux release builds and copies only the main binary. It does not build the Codex bridge, embed its digest, or install the bubblewrap dependency required by the Codex launcher. When Codex release attestation is enabled, Codex will fail closed in the image.

  Fix: Build and hash the bridge in the Dockerfile, embed the digest, copy the bridge into the runtime image, and install bubblewrap; or explicitly keep Codex unavailable in the container release.

---

Reviewers: codex, codex (security) | Synthesis: codex, 8s | Total: 17m15s