feat(orchestrator): durable launch-broker secret via TrustDomain (#468)

Chunk 2 of the host-control-server stack: close the PRD's **durable
secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap.

- trust_domain.py: two new domains. LAUNCH_BROKER holds the durable
  HS256 key both the orchestrator (signer) and the host control server
  (verifier) share for the broker's launch JWT — a host-canonical key
  file minted 0600 on first use, so a restarted orchestrator re-verifies
  against the same key (re-adoption). HOST_CONTROLLER is the separate
  domain for the controller's own lifecycle endpoints, keyed by a key the
  orchestrator never holds (its lifecycle role is `host`, deliberately
  outside the control-plane ROLES). LaunchBrokerProvisioning is the
  fail-closed seam, mirroring ControlPlaneProvisioning.
- orchestrator_auth.py: ROLE_HOST, outside ROLES so the orchestrator's
  control-plane key can neither mint nor accept it.
- paths.py: key-file + env-var constants for both domains.
- host_server.py / __main__.py: broker_secret() now resolves the durable
  LAUNCH_BROKER key — env-injected for a containerized launcher, else the
  host key file for a host-side dev-harness process — so `--broker http`
  and the host controller "just work" on one host without exporting a
  secret, and stay fail-closed when the root is unwritable.

Tested: domain boundary (host role unmintable by the control plane,
cross-domain tokens don't verify), distinct keys/env vars per domain,
provisioning fail-closed, and broker_secret env/file resolution +
durability. Full unit suite green; pyright clean; pylint 9.90.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

bot_bottle/orchestrator/host_server.py

@@ -23,12 +23,15 @@ controller down.
 
 The signed launch token *is* the endpoint's authentication (its provenance is the
 whole point of the JWS), so `/broker` needs no separate caller credential; the
-host controller's own lifecycle endpoints, which do, arrive with the durable
-`TrustDomain` key in a later chunk.
+host controller's own lifecycle endpoints, which do, arrive with the `host`-role
+tokens of the separate `HOST_CONTROLLER` trust domain in a later chunk.
 
-The shared signing secret is read from `$BOT_BOTTLE_BROKER_SECRET` (hex). That is
-a **chunk-1 stopgap**: it must be provisioned to signer and verifier out of band,
-which is exactly what the durable `TrustDomain` key in chunk 2 (#476) replaces.
+The shared signing secret is the durable **launch-broker `TrustDomain` key**
+(#468/#476): a host-canonical key file minted 0600 on first use, provisioned to
+the orchestrator (signer) and this server (verifier). A backend launcher injects
+it via `$BOT_BOTTLE_LAUNCH_BROKER_KEY`; a host-side dev-harness process reads the
+key file directly. Durability is the point — a restarted orchestrator re-verifies
+against the same key, so re-adoption works.
 """
 
 from __future__ import annotations
@@ -43,16 +46,14 @@ import typing
 from urllib.parse import urlsplit
 
 from .. import log
+from ..paths import LAUNCH_BROKER_KEY_ENV
+from ..trust_domain import LAUNCH_BROKER
 from .broker import BrokerAuthError, LaunchBroker
 from .docker_broker import DockerBroker
 
 # JSON body payload type (parsed request / rendered response).
 Json = dict[str, object]
 
-# The hex-encoded HS256 secret shared with the request signer (the orchestrator).
-# Chunk-1 stopgap for the durable, out-of-band `TrustDomain` key of chunk 2.
-BROKER_SECRET_ENV = "BOT_BOTTLE_BROKER_SECRET"
-
 # Default host-controller port. Distinct from the orchestrator control plane
 # (8099) — a separate privileged component listening on its own socket.
 DEFAULT_PORT = 8091
@@ -68,19 +69,22 @@ def _parse_json_object(body: bytes) -> Json:
     return obj
 
 
-def broker_secret_from_env(environ: typing.Mapping[str, str] | None = None) -> bytes | None:
-    """The shared HS256 secret from `$BOT_BOTTLE_BROKER_SECRET` (hex), or None
-    when unset or not valid hex. The signer (orchestrator, `--broker http`) and
-    the verifier (this server) read the same env var so both hold the same key —
-    the chunk-1 stand-in for out-of-band provisioning."""
-    env = os.environ if environ is None else environ
-    raw = env.get(BROKER_SECRET_ENV, "").strip()
-    if not raw:
-        return None
-    try:
-        return bytes.fromhex(raw)
-    except ValueError:
-        return None
+def broker_secret(environ: typing.Mapping[str, str] | None = None) -> bytes | None:
+    """The shared launch-broker HS256 secret, as this process should use it.
+
+    Prefers the key injected into this process's env (`$BOT_BOTTLE_LAUNCH_BROKER_KEY`)
+    — the path a containerized backend launcher uses — and falls back to the
+    durable host key file (`bot_bottle_root()/launch-broker-key`, minted 0600 on
+    first use) for a host-side process like the dev-harness. The signer
+    (orchestrator, `--broker http`) resolves it the same way, so both hold the
+    same key. None only when neither is available (an unwritable host root)."""
+    key = LAUNCH_BROKER.key_from_env(environ)
+    if not key:
+        try:
+            key = LAUNCH_BROKER.signing_key()  # host-canonical, minted on first use
+        except OSError:
+            return None
+    return key.encode("utf-8") if key else None
 
 
 def dispatch(  # pylint: disable=too-many-return-statements
@@ -192,20 +196,21 @@ def main(argv: list[str] | None = None) -> int:
 
         python -m bot_bottle.orchestrator.host_server [--host H] [--port P]
 
-    Fail-closed: without a shared `$BOT_BOTTLE_BROKER_SECRET` the server can
-    verify no request's provenance, so it refuses to start rather than run a
-    launcher that accepts unsigned input."""
+    Fail-closed: without the launch-broker key the server can verify no request's
+    provenance, so it refuses to start rather than run a launcher that accepts
+    unsigned input."""
     parser = argparse.ArgumentParser(prog="bot_bottle.orchestrator.host_server")
     parser.add_argument("--host", default="127.0.0.1", help="bind address")
     parser.add_argument("--port", type=int, default=DEFAULT_PORT, help="bind port (0 = ephemeral)")
     args = parser.parse_args(argv)
 
-    secret = broker_secret_from_env()
+    secret = broker_secret()
     if secret is None:
         sys.stderr.write(
-            f"host controller: refusing to start without a shared signing secret "
-            f"(${BROKER_SECRET_ENV}, hex) — it could verify no request's "
-            "provenance and would relay unsigned launches to the backend\n"
+            f"host controller: refusing to start without the launch-broker key "
+            f"(${LAUNCH_BROKER_KEY_ENV}, or a writable host root to mint it) — it "
+            "could verify no request's provenance and would relay unsigned "
+            "launches to the backend\n"
         )
         sys.stderr.flush()
         return 2
@@ -231,10 +236,9 @@ __all__ = [
     "Handler",
     "HostControlServer",
     "make_host_server",
-    "broker_secret_from_env",
+    "broker_secret",
     "main",
     "Json",
-    "BROKER_SECRET_ENV",
     "DEFAULT_PORT",
 ]