coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Close WP-0039: metered worker identity live with OpenBao-custodied tokens
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Migration 0010 was applied (WP-0038 columns, first production deployment of
WP-0038), and the API was redeployed on activity-core:wp0039-20260923. The loop
claims with 200. The metered token authenticates as
rein-aharness-metered@railiance01, and paired with the loop identity it is
rejected with 403. The manifest declares the live API image.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-24 07:28:07 +02:00
parent 33855c9782
commit 54ab1e41eb
4 changed files with 68 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

12
workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Multiple queue worker identities with OpenBao-custodied tokens"
domain: infotech
repo: activity-core
status: active
status: finished
flavor: implementation
owner: claude-code
topic_slug: activity-core
@ -166,7 +166,7 @@ lands.
```task
id: ACTIVITY-WP-0039-T04
status: progress
status: done
priority: high
state_hub_task_id: "13e90456-02ff-52e7-9296-1fd80761fab4"
```
@ -226,3 +226,11 @@ That also takes WP-0038's close reconciliation live for the first time. Then
redeploy the API on `wp0039-20260923`, and prove the metered identity and the
403 cross-identity rejection. Both need the founder's decision because they go
beyond the worker-identity change.
**Closed 2026-09-24.** On 2026-09-24 the founder ran migration `0010`, and the
API was redeployed on `wp0039-20260923`. The loop claims with 200 as
`rein-aharness@railiance01`. The metered token authenticates as
`rein-aharness-metered@railiance01` (200, nothing claimed), and paired with the
loop identity it is rejected with 403. This also took WP-0038 live for the
first time. Evidence:
`docs/evidence/ACTIVITY-WP-0039-worker-identity-cutover-2026-09-23.md`.