PRD: Host control server - durable launch-broker secret via TrustDomain (chunk 2/5) #497

Open

didericis-claude wants to merge 1 commits from host-control-server-2-secret into host-control-server-1-transport

Author	SHA1	Message	Date
didericis-claude	4b17e6d683	feat(orchestrator): durable launch-broker secret via TrustDomain (#468 ) refresh-image-locks / refresh (push) Successful in 33s Details lint / lint (push) Successful in 1m7s Details test / image-input-builds (pull_request) Failing after 13m0s Details test / integration-docker (pull_request) Has been cancelled Details test / unit (pull_request) Failing after 10m48s Details test / coverage (pull_request) Has been skipped Details tracker-policy-pr / check-pr (pull_request) Successful in 13s Details Chunk 2 of the host-control-server stack: close the PRD's durable secret gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap. - trust_domain.py: two new domains. LAUNCH_BROKER holds the durable HS256 key both the orchestrator (signer) and the host control server (verifier) share for the broker's launch JWT — a host-canonical key file minted 0600 on first use, so a restarted orchestrator re-verifies against the same key. HOST_CONTROLLER is the separate domain for the controller's own lifecycle endpoints, keyed by a key the orchestrator never holds (its role is `host`, deliberately outside control-plane ROLES). LaunchBrokerProvisioning is the fail-closed seam. - orchestrator_auth.py: ROLE_HOST, outside ROLES. - paths.py: key-file + env-var constants for both domains. Key resolution is split by owner (addresses codex review on #497): broker_secret(allow_host_file=...) — the host controller / dev-harness (True) may mint/read the durable host key file it owns; the GUEST orchestrator (--broker http, default False) must be injected the key and fails closed if it isn't. A guest that fell back to the host file would mint a process-local key unrelated to the host controller's, so startup would succeed but every launch would 401 — this prevents that silent divergence. Tested: domain boundary + separation, provisioning fail-closed, and broker_secret env-only (guest) vs host-file (host) resolution. pyright clean; pylint 9.86. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-07-26 22:35:26 +00:00

Author

SHA1

Message

Date

didericis-claude

4b17e6d683

feat(orchestrator): durable launch-broker secret via TrustDomain (#468 )

refresh-image-locks / refresh (push) Successful in 33s

Details

lint / lint (push) Successful in 1m7s

Details

test / image-input-builds (pull_request) Failing after 13m0s

Details

test / integration-docker (pull_request) Has been cancelled

Details

test / unit (pull_request) Failing after 10m48s

Details

test / coverage (pull_request) Has been skipped

Details

tracker-policy-pr / check-pr (pull_request) Successful in 13s

Details

Chunk 2 of the host-control-server stack: close the PRD's **durable
secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap.

- trust_domain.py: two new domains. LAUNCH_BROKER holds the durable
  HS256 key both the orchestrator (signer) and the host control server
  (verifier) share for the broker's launch JWT — a host-canonical key
  file minted 0600 on first use, so a restarted orchestrator re-verifies
  against the same key. HOST_CONTROLLER is the separate domain for the
  controller's own lifecycle endpoints, keyed by a key the orchestrator
  never holds (its role is `host`, deliberately outside control-plane
  ROLES). LaunchBrokerProvisioning is the fail-closed seam.
- orchestrator_auth.py: ROLE_HOST, outside ROLES.
- paths.py: key-file + env-var constants for both domains.

Key resolution is split by owner (addresses codex review on #497):
broker_secret(allow_host_file=...) — the host controller / dev-harness
(True) may mint/read the durable host key file it owns; the GUEST
orchestrator (--broker http, default False) must be *injected* the key
and fails closed if it isn't. A guest that fell back to the host file
would mint a process-local key unrelated to the host controller's, so
startup would succeed but every launch would 401 — this prevents that
silent divergence.

Tested: domain boundary + separation, provisioning fail-closed, and
broker_secret env-only (guest) vs host-file (host) resolution. pyright
clean; pylint 9.86.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-07-26 22:35:26 +00:00

PRD: Host control server - durable launch-broker secret via TrustDomain (chunk 2/5) #497

1 Commits