kind: context
name: cp-service-token
version: 1
description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
requires: []
provides: []

# AU-51b: the ESO-mounted secret is root-owned mode 0400 (init.sh runs as
# root, before the gosu drop to the agent user, uid 1000) — unreadable by
# the agent process directly. Confirmed live 2026-09-03: a real agent
# session hit exactly this ("cp-cli invocation can't proceed... token is
# root-owned mode 0400 so it's not readable by the agent user"). Mirrors
# anthropic-cloud-paul-oauth/v1's pattern: init.sh restages a 0600
# agent-owned copy outside the ESO mount. CP_SERVICE_TOKEN_FILE points at
# the restaged copy, not the raw mount.
#
# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
# (same account: cp-decompose-service-token, account_id
# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
env:
  CP_SERVICE_TOKEN_FILE: /run/agent/cp-service-token/token

scripts:
  init: "./init.sh"

secrets_required:
  - name: cp-service-token
    account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
    mount_path: /run/agent/secrets/cp-service-token
    mode: "0400"