Harden provider routing identity and exact teardown

[jbbottoms]

Change summary

Ship Codex-Orchestration 0.9.3 as the cumulative provider-routing hardening release:

• add bounded first-party Fable, Qwen Token Plan, and Kimi subscription seats;
• bind routing changes to the exact installed/executing plugin, retained package payload, and digest-checked schema-7 state;
• repair provider teardown after the exact plugin is disabled, accepting only provenance-attested Codex 0.145 effective-only MCP defaults;
• preserve real workspace/system/user overrides, concurrent edits, state races, unrelated configuration, and comments by failing closed.

Validation

• python scripts/preflight.py full: compile, Ruff, focused tests, full tests, release identity, and real plugin lifecycle all passed locally.
• Launchpad triad rollback flight e3d6b3b3525b47e7aa92c872ab6fa2bf: rollback and protected live-state checks passed.
• Independent raw-layer flight 138e0225d4e4444d9db9b244b131f061: plugin disabled, teardown returned zero, state removed, explicit managed leaves absent, sentinel preserved, and only the attested effective-only MCP values remained.
• Fresh exact-head review at 55fde317d4160c3b52aa2f475349be309c0a66d6: approved with no Critical/High findings.

Review attestation

{
"schema": 1,
"risk_tier": "security-state",
"repository": "Cjbuilds/Codex-Orchestration",
"base_branch": "main",
"reviewed_head_sha": "55fde317d4160c3b52aa2f475349be309c0a66d6",
"reviewer_identity": "Arendt, fresh Orion exact-head review clanker",
"reviewer_route": "GPT-5.6 Sol Low read-only subagent",
"threat_model": {
"assets": [
"User Codex routing configuration and unrelated comments must survive setup and teardown exactly.",
"Saved provider-routing state and installed plugin identity must remain bound to the executing package.",
"Fable, Qwen, and Kimi subscription credentials and launcher boundaries must remain isolated."
],
"threats": [
"Workspace, system, managed, or concurrent user overrides could be mistaken for synthetic plugin defaults and erased.",
"A changed state digest, inventory record, manifest, package path, or loaded source could substitute attacker-controlled provenance.",
"Malformed layers or unexpected effective values could make teardown report success without exact restoration."
],
"mitigations": [
"Schema-7 state, exact plugin ID, retained package handles, source records, inventory, and state digests are revalidated through the transaction.",
"The exception requires a disabled exact identity, manifest default false, known prior absence, exact user restoration, and absence from every explicit layer.",
"Unexpected values, explicit overrides, okOverridden writes, user races, state races, identity drift, and malformed provenance retain state and fail closed."
]
},
"negative_test_evidence": [
{
"category": "regression",
"evidence": "Five exact provider-teardown regressions passed at the reviewed head, and the full repository preflight plus real plugin lifecycle passed."
},
{
"category": "negative",
"evidence": "Workspace override, concurrent user edit, state-digest race, enabled identity, manifest-default mismatch, effective false, unmanaged MCP, and scalar mismatch cases reject and retain state."
},
{
"category": "malformed",
"evidence": "Malformed layer, malformed or missing retained MCP manifest, ambiguous inventory, package drift, and source identity substitution paths fail closed in targeted tests."
}
],
"findings_disposition": "No Critical or High findings. Historical packaging-only rollback failures are superseded by the exact 0.9.3 triad rollback and independent raw-layer audit; optional observations are non-blocking."
}