Merge pull request 'test(creator-web): support file-backed acceptance secrets' (#101) from codex/wp-400-graph-harness into main

dev/ACTIVE_TASK.json

@@ -1,5 +1,5 @@
 {
   "task_file": "dev/tasks/DEV-000139-production-worker-runtime.json",
   "task_id": "DEV-000139",
-  "task_revision": 1
+  "task_revision": 2
 }

dev/tasks/DEV-000139-production-worker-runtime.json

@@ -1,12 +1,12 @@
 {
   "task_id": "DEV-000139",
-  "task_revision": 1,
+  "task_revision": 2,
   "architecture_revision": "ADR-0018",
   "base_repo_revision": "6f5f7e1",
   "risk_tier": "E",
   "intent": "Run agent and reflection workers as restartable production processes with DB-owned idle wakeups and protected credential refs.",
   "requirement_ids": ["WP-302", "WP-502", "Automatic worker runtime", "Production recovery"],
-  "allowed_change_scope": {"modules": ["work-agent-execution", "epistemics", "deployment"], "paths": ["contracts/secrets/types.go", "modules/work/application/worker.go", "adapters/postgres/work_repository.go", "cmd/agent-worker/main.go", "adapters/postgres/epistemics_repository.go", "cmd/reflection-worker/main.go", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000139-production-worker-runtime.json"]},
+  "allowed_change_scope": {"modules": ["work-agent-execution", "epistemics", "deployment", "creator-web-acceptance"], "paths": ["contracts/secrets/types.go", "modules/work/application/worker.go", "adapters/postgres/work_repository.go", "cmd/agent-worker/main.go", "adapters/postgres/epistemics_repository.go", "cmd/reflection-worker/main.go", "deploy/docker-compose.prod.yml", "tests/creator_web/verify-remote.ps1", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000139-production-worker-runtime.json"]},
   "forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "contracts/authority/**", ".gitea/**"]},
   "allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 2, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
   "contracts": {"consume": ["Existing durable dispatch/reflection tables and file secret resolver"], "may_change": ["Worker process lifecycle and production service wiring"]},

tests/creator_web/verify-remote.ps1

@@ -37,6 +37,19 @@ function Post-CoreJson([string]$url, [object]$body) {
     }
 }
 
+function Get-ContainerSecret([object[]]$environment, [string]$name) {
+    $fileEntry = $environment | Where-Object { $_ -like "${name}_FILE=*" } | Select-Object -First 1
+    if ($fileEntry) {
+        $path = $fileEntry.Substring("${name}_FILE=".Length)
+        $value = docker --context $DockerContext exec $coreContainer sh -c "cat -- '$path'"
+        if ($LASTEXITCODE -ne 0 -or -not $value) { throw "$name file-backed secret is not readable" }
+        return ($value -join "`n").TrimEnd("`r", "`n")
+    }
+    $entry = $environment | Where-Object { $_ -like "${name}=*" } | Select-Object -First 1
+    if (-not $entry) { throw "$name is not configured" }
+    return $entry.Substring("${name}=".Length)
+}
+
 $health = Invoke-RestMethod -Uri "$BaseURL/healthz" -Method Get
 if ($health.status -ne "ok" -or $health.runtime -ne "creator-web") { throw "Creator web health response is invalid" }
 
@@ -52,19 +65,14 @@ $invalid = Invoke-WebRequest -Uri "$BaseURL/api/session/current" -Headers @{Auth
 if ($invalid.StatusCode -ne 401) { throw "Invalid Creator session was not denied" }
 
 $environment = docker --context $DockerContext inspect --format '{{range .Config.Env}}{{println .}}{{end}}' $coreContainer
-$usernameEntry = $environment | Where-Object { $_ -like "CREATOR_USERNAME=*" } | Select-Object -First 1
-$passwordEntry = $environment | Where-Object { $_ -like "CREATOR_PASSWORD=*" } | Select-Object -First 1
-if (-not $usernameEntry -or -not $passwordEntry) { throw "Creator username/password is not configured" }
-$creatorUsername = $usernameEntry.Substring("CREATOR_USERNAME=".Length)
-$creatorPassword = $passwordEntry.Substring("CREATOR_PASSWORD=".Length)
+$creatorUsername = Get-ContainerSecret $environment "CREATOR_USERNAME"
+$creatorPassword = Get-ContainerSecret $environment "CREATOR_PASSWORD"
 $invalidCredentials = Invoke-WebRequest -Uri "$BaseURL/api/session" -Method Post -ContentType "application/json" -Body (@{username=$creatorUsername;password="invalid"} | ConvertTo-Json -Compress) -SkipHttpErrorCheck
 if ($invalidCredentials.StatusCode -ne 401) { throw "Invalid Creator credentials were not denied" }
 $issued = Invoke-RestMethod -Uri "$BaseURL/api/session" -Method Post -ContentType "application/json" -Body (@{username=$creatorUsername;password=$creatorPassword} | ConvertTo-Json -Compress)
 if (-not $issued.Token) { throw "Creator username/password session was not issued through the gateway" }
 
-$bootstrapEntry = $environment | Where-Object { $_ -like "CREATOR_BOOTSTRAP_TOKEN=*" } | Select-Object -First 1
-if (-not $bootstrapEntry) { throw "Creator bootstrap token is not configured" }
-$bootstrapToken = $bootstrapEntry.Substring("CREATOR_BOOTSTRAP_TOKEN=".Length)
+$bootstrapToken = Get-ContainerSecret $environment "CREATOR_BOOTSTRAP_TOKEN"
 $recoveryIssued = Invoke-RestMethod -Uri "$BaseURL/api/session" -Method Post -Headers @{Authorization="Bearer $bootstrapToken"}
 if (-not $recoveryIssued.Token) { throw "Creator recovery session was not issued through the gateway" }
 $current = Invoke-RestMethod -Uri "$BaseURL/api/session/current" -Method Get -Headers @{Authorization="Bearer $($issued.Token)"}