fix(cursor): separate conversation ownership from pool affinity

[luvs01]

Motivation

• A session-wide pool-affinity key was being reused as Cursor conversation ownership, which allowed requests that shared an attacker-controlled session-id but had different thread-ids to collide on Cursor conversation state and remint/checkpoint continuity.

Description

• Add codexThreadConversationKey(headers) in src/codex/lineage.ts to derive a per-thread HMAC identity from the session-id and thread-id pair.
• Use the new per-thread key during request preparation by reading it in src/server/responses/request-prepare.ts so Cursor ownership falls back to the thread-specific identity instead of the cohort-wide pool-affinity key.
• Add a regression test in tests/codex-integration/codex-lineage-placement.test.ts that asserts requests can share pool affinity while keeping distinct per-thread Cursor conversation identities.
• Update structure/providers/cursor.md to document that a session-wide pool-affinity cohort must not be used as Cursor conversation ownership.

Testing

• Ran the focused integration test with bun run test -- tests/codex-integration/codex-lineage-placement.test.ts, which passed (17 tests, 0 failures).
• Ran bun run typecheck, bun run structure:check, and bun run privacy:scan, all of which succeeded.
• Attempted a full bun run test; that run encountered unrelated environment-sensitive failures and timed/ran longer than expected so it was not completed here, but the focused tests and static checks for the modified areas are green.

---

Codex Task

---

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Repository: luvs01/opencodex/.coderabbit.yaml

Review profile: ASSERTIVE

Plan: Advanced

Run ID: e397d4f4-c4ca-44bc-93dc-80a25d2df1cf

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-20T06:30:34.722276Z	534c2bb	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

[github-actions]

✅ Deterministic PR hygiene checks passed.