stack-single 1.4.1

stack-single 1.4.1

A patch for a box that turns agent tokens on with its own client keys file and identity map, and for any box with agent tokens whose gateway is published on an address other than loopback. Three defects, measured on forge on 2026-10-25 when it turned agent tokens on after its 1.4.0 upgrade. Each has a test that was red on 1.4.0, a teeth case and a feature scenario.

Upgrade first

1. A box with its own identity map must bind the enrolled agent in unit agents. vouchryx enrols agent://<trust domain>/agents/operator in unit agents, and the gateway refuses that agent's own token (403 unit_contradicts_map) unless the map binds it in the same unit. Add a unit with id agents, a keys[] entry with key id agents, unit agents and agents agent://<trust domain>/agents/*, and a matching <secret>:agents line in the keys file. The installer keeps that key off the static allow-list, so it admits nothing on its own. Without the binding this release refuses the map before it writes anything. A box whose keys the installer minted has the binding already.
2. A box with agent tokens on whose gateway is published on one address (GATEWAY_BIND in .env): run ./install.sh again. From 1.3.0 to 1.4.0 such a box had the doors' proof origins written for loopback on every run, so every agent token was refused at both doors. This release writes the address the box has.
3. Nothing else changes. A box with agent tokens off, or one whose gateway is on loopback and whose keys the installer minted, sees no difference.

What changed

• ADD_BROKER_KEY=1 installs on the first run (invariant 48, D15). The installer appended the broker's line to the operator's keys file, then refused the map's own broker binding, because the keys checked against the map were read from the file before the line was added. The appended line now joins those keys, as the minted broker key does.
• The doors' DPoP origins follow the bind the box has (invariant 11, D16). The agent-tokens block wrote TOKENFUSE_DELEGATION_URL, MCP_BROKER_DELEGATION_URL and wardryx's door origins from the bind this run started with, before .env was read, so a re-run with nothing in the environment named loopback. The block now takes the bind from .env first.
• A map that cannot admit the enrolled agent is refused (invariant 48, D17). A map that bound agent://<trust domain>/agents/* only to the broker's unit was accepted, and the gateway then refused the operator agent's valid token. The installer now refuses such a map by name.

Measured

• forge, 2026-10-25, turning agent tokens on with its own files on 1.4.0. D15: the first run appended the broker's line, then stopped on "the identity map of the gateway binds key id(s) broker that no client key carries". D16: the origins named 127.0.0.1 on a box published on 192.168.1.10; a valid token was refused 401 at the gateway (Token(WrongKey) in its log), and a proof addressed to 127.0.0.1 passed the token door. D17: with the broker-only binding the gateway answered a valid token 403 unit_contradicts_map.
• forge, the same day, the tree of this release, its own files carrying the agents binding and nothing in the environment but the two file names: 59 installer checks ok, none failed; the origins named 192.168.1.10; no container recreated or restarted; the sorted content of .env unchanged. docs/evidence/agent-token-audience/measure.sh (its agent id set to the box's trust domain): 10 of 10 expectations held. A token was issued, admitted past identity at the gateway (402 at the budget step) and at the broker, and a typed tools/call was answered. A tampered token was refused 401 at both doors.
• Red first: broker-key-is-the-keys-file-line.sh cases C (D15, the keys checked held only felyx) and G (D17, the map was accepted), and agent-tokens-are-wired.sh section K (D16, http://127.0.0.1:4100 for a box bound to 192.168.1.10), each red on 1.4.0 and green here; each has a teeth case that plants the fault again and goes red.

Not measured

• ADD_BROKER_KEY=1 end to end on a live box with this release: forge's keys file already held the broker's line when this tree ran. Case C measures the fixed path against scratch files.
• A CI install leg with an operator's own files and agent tokens on: no leg runs that combination; these three are measured by the gates and on forge.
• Every run with agent tokens on rewrites the token lines of .env and moves them to its end, so the file's bytes change while its values do not.
• The DPoP door origins (TODO(1.4.0, D13) in install.sh): the gateway still accepts a proof for one origin only, so on a box whose origin is its LAN address, a proof addressed to http://tokenfuse-gateway:4100 by an agent on the agents network does not match it. Read from the code, not run.