Grok Build source-first coverage reconciliation
Opened 2026-11-05 UTC before selecting the guide’s controls. Product discovery used the current official Grok Build navigation and the SpaceXSI documentation index, independently of the existing Cursor/Grok Bot guides. Grok Build has its own grok CLI, TOML policy stack and credential/session state; Cursor team controls do not configure it.
No tenants declared — Tier 0+1 only. VERIFIED-LIVE = 0. Product installation, authentication, managed-policy deployment, inference and integrations were not authorized and were not run. Maturity remains ["ai-drafted"].
Source-derived candidates
Sources were retrieved using the web tool on 2026-11-05, with real-browser fallbacks described below. A fetched document proves documented behavior, not runtime enforcement. This ledger was started before guide/pack authoring; the final column records the reconciliation afterward. Before this pass there were 0 dedicated Grok Build controls and 0 Grok Build packs; the adjacent Grok Bot CLI-inventory row did not establish Build coverage.
| ID | Candidate/source section | Plane and content-specific observation | Disposition |
|---|---|---|---|
| GB01 | Enterprise: Configuration | Five TOML layers; system requirements have highest priority, including over environment/remote settings. | Covered — 1.1. Native pin generator/checker; root/source checks remain live work. |
| GB02 | Enterprise: Restricting login methods | Team constraint also disables first-party key auth; credential precedence and BYOK authorization remain distinct. | Covered — 1.1, 4.1, 5.1. Token reuse/refresh, broker protection and revocation boundaries. |
| GB03 | Permissions, Enterprise: Security controls | Ask/Auto/bypass and headless dontAsk; deny wins; root-only native bypass lock. |
Covered — 2.1. Candidate pin, exact user-file limitation, headless/ACP negative tests. |
| GB04 | Sandbox, custom profiles | Off default; macOS child-network restriction no-op; Linux read-deny needs bubblewrap; in-process networking unaffected. | Covered — 2.2. Built-in strict pin; optional unactivated custom definition; no name-only integrity claim. |
| GB05 | MCP servers | Project server replaces same-name user server; compatibility sources; OAuth state persists; inspect shows origin. | Covered — 3.1. Known-server disable and opt-in inventories; explicit no universal allowlist/revocation claim. |
| GB06 | Skills/plugins | Plugins add executable components; skill allowed-tools metadata does not constrain permissions. |
Covered — 3.2. Native/compat sources, marketplace provenance, scopes and inspection. |
| GB07 | Settings: Models and tools | Allowed IDs differ from hidden IDs; per-model URL/key/headers; WebFetch domain/proxy; envrc, goals and delegation. | Covered — 4.1. Candidate restrictions plus explicit endpoint/egress limits. |
| GB08 | CLI reference | Inspection and local lifecycle commands; session deletion/logout/memory clear are separate. | Covered — 5.1. Private read inventory, manual authorized revocation/cleanup runbook. |
| GB09 | ZDR video output | User storage with presigned URLs; credentials stay local; restart; privacy-off changes availability. | Covered — 4.2. Native storage path and lifecycle guidance; no generic bucket provisioner or credential creation. |
| GB10 | Headless | Headless stores sessions; JSON outputs and update-check suppression. | Covered — 2.1, 5.1. Bounded unattended invocation; disabled updates are not assurance. |
| GB11 | Hooks | Only explicit PreToolUse denial blocks; crashes, timeouts and malformed output fail open; project trust covers MCP/LSP. | Covered — 3.2. Trust and failure tests; no false fail-closed hook promise. Browser full-body fallback succeeded. |
| GB12 | Project rules / AGENTS.md | Root-to-working-directory discovery; native and compatible instruction filenames, nested precedence. | Covered — 3.2. Review instructions separately from executable authority. |
| GB13 | Subagents | Default-enabled children, custom agent definitions, behavioral personas. | Covered — 4.1. Disable unnecessary delegation; personas are not policy. |
| GB14 | Background Tasks | Background commands/monitors and recurring loop prompts are running work, separate from todos. | Covered — 4.1, 5.1. Inspect/cancel tasks independently; no imported automation-tool limits. |
| GB15 | Worktrees | Repository copies persist beyond session end/deletion; explicit cleanup required. | Covered — 4.1, 5.1. Checkout isolation is not credential isolation or erasure. |
| GB16 | Agent Dashboard | Native session states, peek/attach and stop/close controls. | Covered — 5.1. Exact dashboard/task paths; inventories do not prove process termination. |
| GB17 | Sessions | Automatic local prompts, responses, tools and file snapshots across TUI/headless/ACP; export/rewind/compact differ from deletion. | Covered — 4.2, 5.1. Local retention and separate exported/worktree copies. Browser full-body fallback succeeded. |
| GB18 | Build changelog, v1.0.51 (Oct 9) | CLI session sharing and /share removed, despite older enterprise network table. |
Excluded removed setting; conflict disclosed in Appendix. No obsolete sharing pack. |
| GB19 | Build changelog, v1.0.67 (Oct 21) | Worktrees inherit main-checkout saved approvals unless opt-out setting is used. | Covered — 2.1. Native opt-out; version prerequisite retained. |
| GB20 | Build changelog, v1.0.64 (Oct 19) | Untrusted folders run managed organization hooks only; headless trusts user hooks. | Covered — 3.2. User CI hooks remain in review scope. |
| GB21 | Build changelog, v1.0.65 (Oct 20) | Any value of telemetry/error-reporting disable variables disables that channel. | Covered — 4.2. Review-only launcher assignments; local crash-report control separate. |
| GB22 | Security FAQ: Grok.com Build mode, consumer FAQ | Hosted retained Build sessions/apps; no Private Chats; improvement toggle includes created-app data; exact web/mobile data paths. | Covered — 6.1. Distinct hosted boundary, consumer-toggle path, no CLI/ZDR inheritance claim. |
| GB23 | Current Build index, Grok FAQ, targeted native-domain searches | No fetched hosted Build audience/auth/secrets/publishing/deletion policy reference established. | Unverified — 6.1. Require current vendor configuration evidence before approving such deployments. |
| GB24 | Build overview, enterprise policy | Windows install/user config documented; equivalent system pin and native sandbox enforcement path not established by fetched references. | Unverified — prerequisites/Appendix. No invented Windows registry/MDM/sandbox pack. |
| GB25 | Security FAQ: Build CLI | CLI privacy slash commands and retention/product-improvement choice are distinct from team ZDR. | Covered — 4.2. Actual /privacy and /settings paths; no guessed TOML key for consent. |
| GB26 | Enterprise network table, newer release note | code.grok.com still described as remote sync/share/relay while CLI sharing removed. |
Unverified remote-sync behavior — Appendix. No unsupported sync toggle or absence claim. |
Reconciliation: 26 candidates: 22 covered, 1 excluded as removed, 3 unverified; 0 remaining documented in-scope guidance omissions. This is a bounded discovery result, not proof that every product feature or undocumented hosted control was found. 9 controls, 9 source packs; 8/9 controls have packs across 2 documented surfaces. Counts measure authored/automated coverage, separately from source discovery and live proof.
Six-surface census
| Surface | Read/write and evidence | Status / decision |
|---|---|---|
| Terraform | No Grok Build provider resource/data-source reference has been verified from the fetched Build index. | Unverified; no provider pack fabricated. Registry search recorded separately below. |
| API (REST and GraphQL) | Developer inference/Management API are separate from Build’s native policy stack. No native Build policy REST/GraphQL write/read handle verified in fetched Build docs. | Unverified for Build policy administration; API controls belong in the separate API guide. |
| CLI | Existing CLI inventory row 123 calls grok adjacent to Grok Bot; current first-party Build command reference documents inspect, MCP/plugin/session inventory and lifecycle commands. |
Available; read pack uses inspect --json, no inference or login. |
| SDK | No official Build policy-admin SDK handle verified in fetched references. | Unverified; do not substitute inference SDK methods. |
| Config | Native managed/user/project TOML, sandbox TOML and inherited compatibility configuration. | Available; generate reviewable fragments and assess supplied files, never install policy. |
| SIEM | Native local logs/session records documented; a stable native security-event export schema was not verified. | Unverified export; no invented Sigma event fields or SIEM pack. |
Per-control interface and lifecycle decisions
The six-surface verdict above applies to each row; unknown Terraform/API/SDK/SIEM capabilities are not relabeled absent. The native CLI is not a Grok Bot admin tool. No native individual-policy CLI setter was verified, but the documented effective-discovery read is useful across every local control. The shared 5.1 collector supplies that read without duplicating it into seven equivalent wrappers.
| Control | Native write/config path | Native read path / supplied pack | Required lifecycle and unproven boundary |
|---|---|---|---|
| 1.1 | Native protected requirements; four documented login methods and OIDC/token-broker config | Config render/verify; shared grok inspect --json in 5.1 |
Root ownership/effective pins and login rejection untested; first-party policy does not constrain BYOK IAM |
| 2.1 | Native root-owned bypass lock, default mode, remembered/inherited approval choices; invocation-specific headless flags | Config render/verify; shared inspect | Root-only lock; old approval state/ACP/headless behavior require product tests |
| 2.2 | Native built-in profile pin; optional user/project custom sandbox definition | Config policy/profile/verify; shared inspect | Built-in strict active in candidate; custom output not activated; OS/kernel/definition integrity unproven |
| 3.1 | Native server enabled flag; compatibility scanner flags; CLI add/remove and TUI configuration documented | Config known-name disable/verify; CLI inspect and MCP list | Not a universal allowlist; package integrity and provider-side OAuth revocation separate; no MCP doctor/connect executed |
| 3.2 | Native compatibility flags; plugin enable/disable/install/uninstall and trust operations documented | Config render/verify; shared inspect/plugin list | Native rules/extensions still need review; no blanket trust; hook failure can allow action |
| 4.1 | Native model/runtime settings; per-model destination fields; tool permissions and task controls | Config render/verify; shared inspect; manual tasks review | Model IDs do not attest URLs; no universal native egress claim; existing work must be stopped separately |
| 4.2 | Native memory/tool config, documented launcher variables, TUI privacy choice, ZDR media-output config | Config policy/environment/verify; shared inspect | No backend-ZDR/telemetry proof; no bucket or credentials created; restart for configured media storage |
| 5.1 | Documented logout, memory/session/worktree lifecycle commands and dashboard task stop | Explicitly gated local version/inspect/plugin/session/worktree list collector | No cleanup/revocation/update executed; local files not an immutable central audit service |
| 6.1 | Consumer web/mobile improvement choice documented; hosted app policy writes remain unverified | Manual data-control confirmation; no fabricated local CLI hosted-admin pack | Retention for publishing continues; no Private Chat; audience/auth/secrets/unpublish/delete evidence needed |
Source retrieval and conflict record
- Hooks and Sessions initially returned “not accessible” to the web tool. Full bodies were subsequently read successfully in helper-owned real-browser group
hth-grok-build. These are successful fallbacks, not evidence of removal. - Enterprise browser navigation timed out with an uncertain outcome. The next action read the existing helper-owned tab, which showed the complete enterprise deployment body; it was not blindly retried. Web retrieval of the same reference also succeeded.
- Project Rules, Worktrees, Background Tasks and Dashboard initially failed direct web opens. Following their observed links from the fetched Subagents navigation returned their real bodies. Canonical sources remained unchanged.
- The specific newer v1.0.51 CLI sharing removal overrides the older enterprise table for sharing recommendations. Remote sync is kept unverified; a removal of sharing does not prove every listed remote function was removed.
- Settings/current changelog and older feature pages differ in recency. Worktree approval inheritance, user hook headless trust and telemetry behavior are version-conditioned and explicitly require a deployed-version test.
- Product naming follows the parent’s independently verified current SpaceXSI family placement. Build’s current first-party legal/FAQ sources were also fetched; this helper does not infer an acquisition date from a page title or legal contracting entity.
Baseline and independent-research sweep
On 2026-11-05, targeted Grok Build searches were run against CIS (cisecurity.org), DISA (cyber.mil), CISA SCuBA (github.com/cisagov), CISA (cisa.gov), NIST (nist.gov), NSA (nsa.gov) and ACSC (cyber.gov.au). No fetched product-specific Build benchmark/STIG/SCuBA/native-configuration baseline was established. Search returned unrelated Grok-model/deepfake/general-AI material and unrelated historical “grok” software CVEs; these were not admitted as Build configuration authority. This is unverified product-specific baseline coverage, not proof none exists. Compliance tables map control intent using standard control families/IDs, not a nonexistent Build benchmark.
Targeted standing-list sweeps used Grok Build with Wiz, Trail of Bits, PromptArmor, Pillar Security, Embrace The Red, Zenity Labs, GitGuardian and NeuralTrust domains. No product-specific native Build technical finding was established in the returned results. No generic Grok-chat or Grok Bot prompt-injection incident was presented as a Build CLI exploit. No new Tier 3/4 source was cited and no standing-source metadata change is needed.
The Terraform registry query site:registry.terraform.io xai grok build provider returned unrelated Azure cognitive-deployment material, not a first-party Build policy resource/data-source index. The current Build overview/navigation, enterprise/config/CLI references and targeted native-domain queries for hosted Build publishing/secrets/auth did not establish a Build admin API/SDK/provider. These remain unverified instead of categorical no-interface claims. Generic bucket, host firewall, IdP, secret-manager and endpoint-management administration remains in those products’ guides; this guide documents the Build-specific boundary and prerequisites.
Offline and live validation record
bun test ./scripts/test-grok-build-packs.ts: 10 pass, 0 fail, 144 assertions (2026-11-05). Uses the real Bun TOML parser and a synthetic first-party-CLI replacement only. Covers every pack’s Bash syntax/default no-product-call behavior; typed/missing/malformed/duplicate policy rejection; hostile input; default built-in versus unactivated custom profile; exact read-only argv; gated collection; private evidence modes; redaction; native-command failure; inventory results never claiming compliance.- Nine pack files have Contract v1 headers and unique section/type pairs; seven native-config generators/checkers plus two CLI collectors. Fixtures prove wrapper boundaries and file parsing, not vendor schema acceptance, effective pins, native output shape or runtime authorization.
- Isolated scratch-copy
sync-packs-to-data.shgenerated 9 files → 8 sections; isolatedvalidate-packs.sh grok-buildended ALL TESTS PASSED (1 warning). The warning is the new CLI-inventory row, delegated to parent metadata integration. Host-policy check was SKIPPED because that optional file is absent in the source checkout. A separate read-only anatomy check found 9 complete control rows, 8 pack includes, zero fences, zero defects. Scratch validation did not write shared generated data. - No Grok binary was installed, authenticated or called. No hook/MCP/server/ACP session or inference was started. Hosted Build privacy/publishing controls were not changed. Live checks are SKIPPED / NEEDS-TENANT, with VERIFIED-LIVE = 0.
- Whole-repository sync/render/bookkeeping and independent review are recorded by the parent refresh lane. This helper did not mutate shared metadata or Git state; the files remain in the assigned worktree for integration.
Provider supplemental evidence
The official Cursor provider v0.8.0 release, published 2026-10-08, resolves to commit 48c8203395b6bdf0043401832415903ddbc1e9ab. Its registered resources and data sources contain 9 resources and 6 data sources for Origin and platform workflows. This corrects any family-wide no-provider conclusion; it does not establish a Grok Build managed-policy resource. The annotated release tag is unsigned; downloaded provider package verification is a separate act.
On 2026-11-05, only the authored Origin and Cloud Agents Terraform directories were copied to /tmp/hth-cursor-provider-validation.dy61sS/origin and /tmp/hth-cursor-provider-validation.dy61sS/cloud. With Terraform 1.17.1, darwin_arm64, each copy ran terraform init -backend=false -input=false -no-color, then terraform validate -no-color. Both final validations returned Success! The configuration is valid. Initialization downloaded the exact pinned cursor/cursor 0.8.0, reporting its verified developer signature key ID 5E389DAC0B402A90 (self-signed). Provider binaries and generated lock files stayed in those temporary copies; none were installed into the repository.
Commands used env -i with only an explicit executable path, temporary-directory and Terraform runtime variables, plus an empty temporary TF_CLI_CONFIG_FILE. No vendor credentials, Terraform variable secrets or inherited CLI credential helper were supplied. Sandbox DNS initially prevented registry discovery, and sandbox execution prevented the provider handshake; authorized network/local-process execution completed these checks. No plan, apply, import, authentication, credential exchange or tenant API operation ran. Validation checks provider schema and local configuration; it does not prove permission, reachability, native enforcement or live behavior.
The first Origin validation exposed a v0.8.0 provider value-conversion error when an unknown-length dynamic required_check list reached its validator. The pack now uses an explicit block and a nullable hth_required_check object; an opt-in precondition requires the actual trusted check. Additional existing checks must be preserved as explicit blocks because ruleset updates replace the full protection lists. The corrected Origin configuration and the Cloud Agents configuration both passed against the downloaded provider.
For Origin 3.4, the current native API reference documents trustAppDeclaredIps, whereas the pinned allowlist resource and entries data source expose neither its setter nor readout. The example therefore leaves that existing exception unchanged and labels it unassessed; its Terraform output cannot establish the whole inbound policy. Native API review is required. This is source-only evidence, with no tenant confirmation. The settings documentation does not establish an IP-allowlist or SSH-CA GUI path, so neither menu is invented.