Issued attic tokens by default: nodes join with no secret files #31
Loading…
Reference in a new issue
No description provided.
Delete branch "auto-attic-tokens"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Joining a build node no longer needs a secret file. Add the agent and cache-client options, switch, and approve the node in the UI.
Until now, #13's per-node attic tokens never reached any node.
issueAgentTokenswas off, and even with it on, agents declared trust 0 and approvals defaulted to 0, belowcache_push_min_trust = 1.max_trust = 1, an ordinary build node that may push. 0 means build-only.max_trustin place (POST /api/agent-tokens/{id}/trust, plus a form on/ui/tokens). Live sessions are closed as on revocation and re-admitted at the new cap, which re-decides their attic token.cache.server.issueAgentTokensdefaults to on when the control plane runs on the cache host.cache.client.tokenFileis optional, and leaving it unset is now the usual case.🤖 Generated with Claude Code
A token-holding agent now declares the most its token allows (u8::MAX) unless configured otherwise, so the operator's grant is its trust; a tokenless agent still declares 0. Minting and approval default to max_trust 1, an ordinary build node that may push to the cache (0 is build-only), and the forms say so. An unrevoked token's max_trust can be changed in place (admin-only: POST /api/agent-tokens/{id}/trust, and a form on /ui/tokens). Sessions admitted under another cap are closed like on revocation, with the same born-closed rule for one verified before the change; the agent reconnects and is re-admitted at the new cap, which re-decides its attic token. Module: cache.server.issueAgentTokens defaults to on when the control plane runs on the cache host; cache.client.tokenFile stays optional and unset is the usual case. The module check covers a joining node on its issued token and the server host rendering [attic]. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>CI green on this head.
@krisbuild r+
Merged as
66a59afafd.