# Provider Readiness Debug Journal Started: 2026-08-15T12:34:48Z Goal: Establish an exact-candidate provider readiness PASS without exposing credentials or mutating unrelated state. ## Environment snapshot - Runtime: Python, launcher `/home/cube/projects/richard/hermes-agent/.venv/bin/dualcoach_admin` - Failed command: `dualcoach_admin provider-auth check --json --receipt-dir --allow-billable-active-probe` - Observed exit: `36` - Observed error: `openai-codex requested but no Codex OAuth token found` - Observed command candidate digest: `f9a46172386333a0067f43695fb1429a043a606f04baceb06e8c59b90c36235c` - Required release candidate: `2e0894eac92bc396cc4723bf1f18ebc653b95018dd41574df435941c235da925` - Required wheel: `af4a9d0a1ffffb6eb7551c1d6dc2b32853ca6d024332a4f8f5702bbf992f141b` - References read: debugging skill, Python runtime, setup, investigation, partial-runtime-evidence. ## Hypotheses 1. **H1 — wrong runtime build.** The repository venv is a predecessor install whose provider checker both reports the wrong candidate digest and includes its own receipt writes in the profile-mutation snapshot. Distinguishing evidence: candidate-wheel checker behavior differs under the same redacted environment. If true: candidate-bound probe. 2. **H2 — credential truly absent.** No valid Codex OAuth credential is discoverable by the actual provider adapter. Distinguishing evidence: every supported resolver path reports absent without revealing token material. If true: supported reauthentication. 3. **H3 — credential context omitted.** A valid credential exists but the manual command lacks service/profile environment or config resolution used by the gateway. Distinguishing evidence: systemd/profile environment names or resolver inputs differ from the failed process and resolve successfully when reproduced without printing values. If true: load profile context. 4. **H4 — receipt snapshot contract bug.** The checker treats its authorized receipt/index writes as forbidden profile drift. Distinguishing evidence: pre/post delta contains only the declared receipt directory. If true: isolate or fix snapshot scope. ## Failed hypothesis round counter - Round 1: H1, H2, and H4 refuted; H3 confirmed. ## Artifacts to reconcile - [ ] Provider-auth receipt/index writes created by the failed authorized probe; retain only as redacted FAIL evidence and bind their exact paths/hashes. - [ ] Any disposable candidate-wheel environment created during investigation; remove after use. - [ ] Any temporary logs or caches; remove after use. ## Findings ### 2026-08-15T12:34:48Z — supported provider probe - Source: command stdout/stderr. - Value: exit `36`; `no Codex OAuth token found`; `success=false`; `result=profile_mutated`; `billable=false`; `request_attempts=null`. - Interpretation: no external model request occurred. The command also did not run from the required candidate build. - Confirms/refutes: H1 supported; H2 or H3 unresolved; H4 supported but delta not yet classified. ### 2026-08-15T12:40:00Z — receipt and protected-state delta reconstruction - Source: independent lane `st_01a0056e`. - Value: `--receipt-dir` did not select the profile. `get_hermes_home()` resolved `/home/cube/.hermes`. The pre/post snapshot delta was `/home/cube/.hermes/auth.json`; the declared receipt and index outputs were excluded from that snapshot. - Value: global auth bookkeeping marked the Codex pool entry exhausted after refresh found no usable runtime token. No model request occurred (`request_attempts=null`, `billable=false`). - Value: exact output effects were one new private receipt and one private index replacement under the dualcoachtest provider-auth receipt directory, plus the protected global auth mutation. - Interpretation: `profile_mutated` was correct but masked the underlying missing-credential outcome. The candidate-bound retry must select the canonical profile explicitly and must forbid undeclared global/shared auth changes. - Confirms/refutes: H4 refuted; H1 supported; H2 versus H3 remains unresolved. ### 2026-08-15T12:42:51Z — profile-bound non-billable check - Source: `HERMES_HOME=/home/cube/.hermes/profiles/dualcoachtest dualcoach_admin provider-auth check --json`. - Value: exit `29`; `result=probe_unknown`; `active_probe_authorized=false`; `request_attempts=null`; `billable=false`; candidate digest still predecessor `f9a461...`. - Interpretation: the correct profile context no longer reports missing credentials. OpenAI Codex readiness is intentionally inconclusive without the authorized active probe. A candidate-bound active probe is still required. - Confirms/refutes: H2 refuted for the profile-bound adapter path; H3 confirmed; H1 remains open until the sealed-wheel invocation is established. ### 2026-08-15T12:45:00Z — provider command digest-domain audit - Source: independent lane `st_01a0056c`, installed RECORD, sealed wheel closure, historical successful rebind receipt. - Value: installed and sealed-wheel `gateway/platforms/dualcoach_admin.py` are byte-identical at SHA-256 `0e9b4b1f0449d8351602598fead3ef01b8616e230c147e44db79667284ceae49`. - Value: that module deterministically emits command candidate digest `f9a46172386333a0067f43695fb1429a043a606f04baceb06e8c59b90c36235c`. - Value: `2e0894...` is the full repaired-archive successor envelope identity, not the provider command digest domain. - Interpretation: the current venv checker behavior is candidate-equivalent for the provider gate even before full-wheel deployment. The remaining blocker is only correct profile context plus the authorized active probe. - Confirms/refutes: H1 refuted; H3 confirmed. ### 2026-08-15T12:44:22Z — authorized profile-bound active probe - Source: `HERMES_HOME=/home/cube/.hermes/profiles/dualcoachtest dualcoach_admin provider-auth check --allow-billable-active-probe`. - Value: exit `0`; `result=ready`; `success=true`; `request_attempts=1`; `billable=true`; `store=false`; `sdk_max_retries=0`; response `completed`. - Value: protected profile snapshot unchanged at `7d163cb01708869d617efeadd852f7e6ec4f963a94c50d19b104cc849483c171`. - Value: usage was 17 input, 9 output, 26 total tokens. Delivery, registry, service, and Telegram actions were zero. - Value: private receipt SHA-256 `6aeaaab42e0030b0f626037d7b9ef6661ec93fb57fd991c843967c1fc695905c`; index names `20260815T124422Z-72c8a29e63504cf5a66c75966e4ae266.json`. - Interpretation: provider readiness is conclusively PASS under the exact gateway profile context and candidate-equivalent provider module. - Confirms/refutes: H3 confirmed as root cause; all other hypotheses refuted.