3717fc8167
Env-only layer exporting CP_WRITE_TOKEN_FILE=/run/agent/cp-write-token/token. The per-step wfcw_ token is delivered by the dispatcher into the script container only (AU-55b), so the layer has no secrets_required, init script or files. Not referenced by any composite yet; safe to merge at any time. Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
26 lines
1.3 KiB
YAML
26 lines
1.3 KiB
YAML
kind: context
|
|
name: cp-write-token
|
|
version: 1
|
|
description: "Per-step scoped CP write token (AU-55, Option C): points CP_WRITE_TOKEN_FILE at the wfcw_ bearer the dispatcher delivers into the script container only (spec/typed-workflows.md WF-COMP-31c, spec/authentication.md AU-55b)"
|
|
requires: []
|
|
provides: []
|
|
|
|
# AU-55b delivery: the token does NOT exist at manifest-submit time, so it is
|
|
# NOT a secrets_required / ESO mount and NOT under /variables/. The dispatcher
|
|
# mints it at dispatch (mint_step_tokens, scope='cp_write') and delivers it
|
|
# into the script container ONLY:
|
|
# - Kubernetes: item `cp-write-token` of the per-task wfvars-<task_id>-<gen8>
|
|
# Secret, projected at the path below (mode 0440 + pod fsGroup, so the
|
|
# non-root agent uid can read it).
|
|
# - Docker: create -> put_archive -> start on the script container (never the
|
|
# wfvars-* data volume).
|
|
# This layer therefore carries env only: no init script, no secrets_required,
|
|
# no files. It must stay that way; a secrets_required entry here would make the
|
|
# dispatcher wait on an ESO secret that never exists.
|
|
#
|
|
# The token is only valid on the two AU-57 routes for the run's own item
|
|
# (PATCH / GET /v1/work-items/{id}). It is NOT the AU-51 internal bearer;
|
|
# cp-service-token/v1 is deliberately not layered alongside it.
|
|
env:
|
|
CP_WRITE_TOKEN_FILE: /run/agent/cp-write-token/token
|