- Add scripts/provision-hub-tokens.sh. It adds the five HUB_TOKEN_* keys to
~/.config/environment.d/10-secrets.conf. It is idempotent, keeps mode 600,
leaves a mode-600 backup, and never prints a value. It uses openssl when
present and /dev/urandom otherwise (this host has no openssl).
- docker-compose.yml: run the container as the host user. The image's
distroless nonroot user cannot read the 0600 secrets file. With nonroot the
Hub read no tokens and every /ask returned 401.
- Document the deploy steps, the finding, and the dry-run evidence in
docs/outline/04-agent-runbook.md, docs/outline/02-config-and-env.md, README.md.
Dry run on port 18788 with a scratch secrets file: /health ok with
omniroute ok, control action refused, bad token 401. The host secrets file and
the running hub container were not touched.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Sam Rolfe
4d87124840