Hare/yoi
1
1
Fork 0
Code Actions Packages Releases Activity

workspace: remove worker credential refresh flow

Browse Source
This commit is contained in:
Hare
2026-08-03 17:08:23 +09:00
parent ddadc830ac
commit 0ffaa6c741
17 changed files with 184 additions and 976 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/report/2026-07-30-restored-worker-workspace-credential-stale.md
+3 -8
View File
@@ -16,13 +16,8 @@ The Server control-plane DB contained a current active `worker_workspace_credent
- A Worker cannot report or ticket the restore regression through the intended typed authority.
- The failure is easy to misattribute to the Browser multiplexer; in this incident Browser authentication/bootstrap was a separate issue.
## Suggested investigation
## Resolution
Trace the credential lifecycle across Backend restart and Runtime Worker restore:
The per-Worker bearer credential was removed rather than adding restore-time secret rotation and reinjection. Worker Workspace requests now carry the Runtime/Worker identity binding established by Runtime, and Server verifies that identity against the current Runtime catalog before applying Ticket role/assignment gates.
1. whether Backend rotates or recreates the credential record;
2. whether restored Worker execution receives the current plaintext credential rather than retaining an old environment/config bundle;
3. whether credential binding should remain stable across Backend restart or be explicitly refreshed before marking the Worker restored;
4. whether restore health should include a bounded Workspace API authentication probe.
Do not treat a current DB credential row alone as proof that the restored Worker possesses it.
The removal also deletes token mint/rotate/revoke/refresh behavior, live Worker token replacement, and the control-plane credential table. Runtime/Server trust remains the security boundary; Worker role checks remain the accidental-misuse gate.