didericis-claude
4a83f45d9d
tracker-policy-pr / check-pr (pull_request) Successful in 9s
test / integration-docker (pull_request) Successful in 17s
test / unit (pull_request) Successful in 46s
test / integration-firecracker (pull_request) Successful in 3m27s
test / coverage (pull_request) Successful in 26s
test / publish-infra (pull_request) Has been skipped
The previous firecracker fix let the VM generate its own signing key on the guest volume and had the host overwrite the single host-wide control-plane-token with it. That breaks a co-running Docker/macOS control plane: their orchestrators still verify with the old key while new host clients start signing `cli` tokens with the guest key, so supervise/teardown/policy calls against those backends begin returning 401 (cross-backend operation is supported). Keep the host token file the single source of truth. The launcher now pushes the host-canonical key into the freshly booted infra VM over SSH (atomic write, mirroring persist_env_var_secret); the VM's init waits for it and refuses to start the control plane — rather than run open — if it never arrives. Nothing ever writes back to the host file, so other backends are untouched, and the best-effort silent path is gone (both the push and the guest fail loudly). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>