kind: context
name: cp-service-token
version: 1
description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
requires: []
provides: []

# AU-51b: static env pointing at the ESO-mounted secret file. No init.sh
# needed — the mount path is fixed at harness-authoring time (unlike
# anthropic-cloud-paul-oauth/v1, which transforms its secret into a
# different file format and therefore needs a staging script), and
# decompose_work_items_action reads CP_SERVICE_TOKEN_FILE directly.
# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
# (same account: cp-decompose-service-token, account_id
# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
env:
  CP_SERVICE_TOKEN_FILE: /run/agent/secrets/cp-service-token/value

secrets_required:
  - name: cp-service-token
    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
    mount_path: /run/agent/secrets/cp-service-token
    mode: "0400"