· ENPT-BR
Grok Build for Alembic · Honest operation

Production boundaries: roster, Docker, credentials

Keep a successful opt-in provider from silently becoming an unproven production dependency.

Primary source
Pinned authentication guide

Pinned upstream commit: b189869b7755d2b482969acf6c92da3ecfeffd36

The Simple layer stands alone; open Technical for exact contracts and edge cases.
You will be able to
  • Distinguish provider availability from roster selection.
  • List Docker prerequisites without performing an unapproved rollout.
  • Keep secrets outside commands, artifacts, and logs.
1

The big idea

Adding `factory.grok()` makes a capability available to explicit callers. It does not install Grok in the Factory image, authenticate a container, or add Grok to the fixed planner/implementer/reviewer roster. Those are separate decisions with separate proof gates.

Think of it like… Installing a new instrument in the storeroom does not rewrite the orchestra's score or put a musician on stage. The analogy breaks because a CLI also needs credentials, network, version pinning, and sandbox policy before the stage exists.

`.factory/run.ts` remains a small explicit roster: Claude for planning/publishing and Codex routes for implementation/review. `.factory/Dockerfile` installs pinned Codex and Claude tooling, not Grok. Provider export is additive library surface only.

For CI/container use, the upstream auth guide supports `XAI_API_KEY` and device/external auth flows; stored browser credentials take precedence when present. A production design must choose one injection method, prevent logging, pin the CLI, and prove the exact image. It must not copy `~/.grok/auth.json` casually.

Evidence: Pinned authentication guide

providerexporthostDockerfilebinary pin Safe: explicit caller, injected secret, pinned image, independent smoke.
Keep a successful opt-in provider from silently becoming an unproven production dependency.
2

Compare the boundaries

Safe
Safe: explicit caller, injected secret, pinned image, independent smoke.
Risky
Risky: auto-route to a host-only CLI or copy personal auth into an image.
SurfaceUpstreamAlembicVerdict
Library export`factory.grok()` availableAlready implementedOPT-IN
Factory imagePinned binary + auth + networkGrok not installedFUTURE
Fixed rosterPlanner/implementer/reviewer choiceNo Grok routeUNCHANGED

For CI/container use, the upstream auth guide supports `XAI_API_KEY` and device/external auth flows; stored browser credentials take precedence when present. A production design must choose one injection method, prevent logging, pin the CLI, and prove the exact image. It must not copy `~/.grok/auth.json` casually.

3

Real code and commands

.factory/run.ts + .factory/Dockerfile
rg -n "planner:|implementer:|reviewer:" .factory/run.ts
rg -n "codex|claude|grok" .factory/Dockerfile

# Current evidence:
# .factory/run.ts -> Claude/Codex fixed roster
# .factory/Dockerfile -> Codex + Claude install; no Grok
How to reach it
sed -n '1,90p' .factory/run.ts
sed -n '1,90p' .factory/Dockerfile
sed -n '1,70p' packages/factory/README.md

Evidence: RESOURCES.md

4

Visual atlas

inputproofprovider
Trace the boundary: provider.
surfaceseamownerexport
Locate the owner: export.
claimwithout gateevidenceat boundaryvshost
Compare claim and evidence: host.
learnexecuteverifyDockerfile
Read the sequence: Dockerfile.
complete?yes / nobinary pin
Find the decision gate: binary pin.
inputproofXAI_API_KEY
Trace the boundary: XAI_API_KEY.
surfaceseamownerauth.json
Locate the owner: auth.json.
claimwithout gateevidenceat boundaryvsnetwork
Compare claim and evidence: network.
learnexecuteverifysandbox
Read the sequence: sandbox.
complete?yes / noin-image smoke
Find the decision gate: in-image smoke.
inputproofrun.ts
Trace the boundary: run.ts.
surfaceseamownerplanner
Locate the owner: planner.
claimwithout gateevidenceat boundaryvsreviewer
Compare claim and evidence: reviewer.
learnexecuteverifyroster
Read the sequence: roster.
5

Practice and feedback

Predict before revealing

`factory.grok()` works on the host. Can `.factory/run.ts` route production work to it now?

No. The image, credential path, and production routing are separate unproven boundaries.

Retrieval cards

Retrieval cardsLibrary surfaceClick or press Enter to flip
Library surfaceCapability available to explicit callers.
Retrieval cardsFixed rosterClick or press Enter to flip
Fixed rosterThe declared providers used by the production flow.
Retrieval cardsImage proofClick or press Enter to flip
Image proofSmoke inside the exact pinned container.
Retrieval cardsSecret injectionClick or press Enter to flip
Secret injectionRuntime credential delivery without artifact leakage.
Adding `factory.grok()` makes a capability available to explicit callers. It does not install Grok in the Factory image, authenticate a container, or add Grok to the fixed planner/implementer/reviewer roster. Those are separate decisions with separate proof gates.
`.factory/run.ts` remains a small explicit roster: Claude for planning/publishing and Codex routes for implementation/review. `.factory/Dockerfile` installs pinned Codex and Claude tooling, not Grok. Provider export is additive library surface only.

Toggle the production layers

Select a layer and see its prerequisite and current status.

Verdict

Four-slide summary

Library surface

Capability available to explicit callers.

Fixed roster

The declared providers used by the production flow.

Image proof

Smoke inside the exact pinned container.

Secret injection

Runtime credential delivery without artifact leakage.

Check your model

Spaced review

What changes when `factory.grok()` is exported?

The library gains an explicit constructor; roster and image remain unchanged.
6

Sources and next move

Pinned authentication guideb189869b7755 · authPinned headless mode guideb189869b7755 · headlessPinned session management guideb189869b7755 · sessionsRESOURCES.mdGrok Build for Alembic
Ask your teacher to challenge a verdict, replay an event, or review a future unit against the same proof discipline.