didericis-claude
1a25243505
prd-number-check / require-numbered-prds (pull_request) Failing after 12s
tracker-policy-pr / check-pr (pull_request) Successful in 13s
test / integration-docker (pull_request) Successful in 20s
lint / lint (push) Failing after 56s
test / unit (pull_request) Failing after 4m4s
test / coverage (pull_request) Has been skipped
Chunk 2 of the host-control-server stack: close the PRD's **durable secret** gap and replace chunk 1's BOT_BOTTLE_BROKER_SECRET stopgap. - trust_domain.py: two new domains. LAUNCH_BROKER holds the durable HS256 key both the orchestrator (signer) and the host control server (verifier) share for the broker's launch JWT — a host-canonical key file minted 0600 on first use, so a restarted orchestrator re-verifies against the same key (re-adoption). HOST_CONTROLLER is the separate domain for the controller's own lifecycle endpoints, keyed by a key the orchestrator never holds (its lifecycle role is `host`, deliberately outside the control-plane ROLES). LaunchBrokerProvisioning is the fail-closed seam, mirroring ControlPlaneProvisioning. - orchestrator_auth.py: ROLE_HOST, outside ROLES so the orchestrator's control-plane key can neither mint nor accept it. - paths.py: key-file + env-var constants for both domains. - host_server.py / __main__.py: broker_secret() now resolves the durable LAUNCH_BROKER key — env-injected for a containerized launcher, else the host key file for a host-side dev-harness process — so `--broker http` and the host controller "just work" on one host without exporting a secret, and stay fail-closed when the root is unwritable. Tested: domain boundary (host role unmintable by the control plane, cross-domain tokens don't verify), distinct keys/env vars per domain, provisioning fail-closed, and broker_secret env/file resolution + durability. Full unit suite green; pyright clean; pylint 9.90. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>