fix(deploy): migrate hub commands to scoped tokens #249

Merged

gmackie merged 1 commit from fix/public-feed-scheduler-hub-token into main

2026-08-05 10:41:10 +00:00

gmackie commented

2026-08-05 10:32:24 +00:00

Owner

What changed

add nonce-bearing HMAC command tokens scoped to one node and explicit command types
migrate the Go CLI, Tailscale/database helpers, and Git bridge dispatchers to mint and reuse scoped tokens
bind command-result polling to the exact dispatch credential
upgrade the command hub before the Worker with a last-good binary, rollback watchdog, and required-node reconnect gate
keep legacy command credentials behind an explicit observable migration flag for this rollout only

Rollout

This is phase A of a two-phase migration. The deploy requires both scoped-token support and legacyCommandTokens: true before promoting the Worker. A follow-up PR will remove the migration flag after this PR is live and scoped callers are proven.

Verification

pnpm test (8/8 tasks; web 779 passed, 40 skipped)
pnpm typecheck (9/9 tasks)
pnpm lint (0 errors; existing warnings only)
cd agent && go test ./...
Prettier, Bash syntax, and workflow YAML parsing

## What changed - add nonce-bearing HMAC command tokens scoped to one node and explicit command types - migrate the Go CLI, Tailscale/database helpers, and Git bridge dispatchers to mint and reuse scoped tokens - bind command-result polling to the exact dispatch credential - upgrade the command hub before the Worker with a last-good binary, rollback watchdog, and required-node reconnect gate - keep legacy command credentials behind an explicit observable migration flag for this rollout only ## Rollout This is phase A of a two-phase migration. The deploy requires both scoped-token support and `legacyCommandTokens: true` before promoting the Worker. A follow-up PR will remove the migration flag after this PR is live and scoped callers are proven. ## Verification - `pnpm test` (8/8 tasks; web 779 passed, 40 skipped) - `pnpm typecheck` (9/9 tasks) - `pnpm lint` (0 errors; existing warnings only) - `cd agent && go test ./...` - Prettier, Bash syntax, and workflow YAML parsing

gmackie added the

forgegraph:public-update

label

2026-08-05 10:32:24 +00:00

gmackie added 1 commit

2026-08-05 10:32:24 +00:00