38cd0b040b
New context mounts the cp-decompose-service-token account (system
provider type, account_id 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner
(cp, cp)) via ESO and exports CP_SERVICE_TOKEN_FILE pointing at the
mounted secret file. Wired into spec-writing-sonnet-repo (backs
scope-decompose-sonnet@1, which calls back POST
/v1/work-items/{id}/decompose — bug b3a96acc / fa41caac / M42 stall).
The mounted value must match the CP's CP_INTERNAL_BEARER_TOKEN
(agent-runtimes deploy repo, overlays/{production,staging}/app-secret.sops.yaml).
No init.sh needed — the mount path is static at harness-authoring time
and entrypoint/actions/decompose_work_items.py (AU-51b, agent-runtimes
commit 0fa8b760) reads CP_SERVICE_TOKEN_FILE directly, so no
transformation/staging step is required.
24 lines
997 B
YAML
24 lines
997 B
YAML
kind: context
|
|
name: cp-service-token
|
|
version: 1
|
|
description: "CP-internal service bearer token — authenticates agent-container write calls back to the control plane (AU-51/AU-51b, bug b3a96acc)"
|
|
requires: []
|
|
provides: []
|
|
|
|
# AU-51b: static env pointing at the ESO-mounted secret file. No init.sh
|
|
# needed — the mount path is fixed at harness-authoring time (unlike
|
|
# anthropic-cloud-paul-oauth/v1, which transforms its secret into a
|
|
# different file format and therefore needs a staging script), and
|
|
# decompose_work_items_action reads CP_SERVICE_TOKEN_FILE directly.
|
|
# The value at this path MUST match the CP's CP_INTERNAL_BEARER_TOKEN
|
|
# (same account: cp-decompose-service-token, account_id
|
|
# 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner (cp, cp)).
|
|
env:
|
|
CP_SERVICE_TOKEN_FILE: /run/agent/secrets/cp-service-token/value
|
|
|
|
secrets_required:
|
|
- name: cp-service-token
|
|
account_ref: "1d963673-6ac9-4f85-875a-2ce5323e76ad"
|
|
mount_path: /run/agent/secrets/cp-service-token
|
|
mode: "0400"
|