kind: context
name: cp-write-token
version: 1
description: "Per-step scoped CP write token (AU-55, Option C): points CP_WRITE_TOKEN_FILE at the wfcw_ bearer the dispatcher delivers into the script container only (spec/typed-workflows.md WF-COMP-31c, spec/authentication.md AU-55b)"
requires: []
provides: []

# AU-55b delivery: the token does NOT exist at manifest-submit time, so it is
# NOT a secrets_required / ESO mount and NOT under /variables/. The dispatcher
# mints it at dispatch (mint_step_tokens, scope='cp_write') and delivers it
# into the script container ONLY:
#   - Kubernetes: item `cp-write-token` of the per-task wfvars-<task_id>-<gen8>
#     Secret, projected at the path below (mode 0440 + pod fsGroup, so the
#     non-root agent uid can read it).
#   - Docker: create -> put_archive -> start on the script container (never the
#     wfvars-* data volume).
# This layer therefore carries env only: no init script, no secrets_required,
# no files. It must stay that way; a secrets_required entry here would make the
# dispatcher wait on an ESO secret that never exists.
#
# The token is only valid on the two AU-57 routes for the run's own item
# (PATCH / GET /v1/work-items/{id}). It is NOT the AU-51 internal bearer;
# cp-service-token/v1 is deliberately not layered alongside it.
env:
  CP_WRITE_TOKEN_FILE: /run/agent/cp-write-token/token