Summary
PR #133 closes the in-process harness exit paths for #109 (fail-closed token revocation on intermediate stage failure). Two leak paths remain that the harness cannot cover — they require a controller-side or Hub-side janitor:
-
Pod killed without defers running (OOM / node loss / preemption). The harness never executes its revocation defer, so the token survives until TTL.
-
Intermediate success where the next stage never runs. The current stage succeeds and correctly preserves the token for the next stage, but that stage is never created (controller create failure, AgentWorkflowRun deleted between stages, etc.). No process ever revokes the token.
Both cases leave a valid Hub API token dangling until TTL expiry.
Possible approaches
- Controller finalizer on AgentRun / AgentWorkflowRun: revoke any associated token when the resource is deleted or transitions to a terminal state without a successor stage.
- Hub-side TTL sweep: periodic cleanup of tokens past their expected lifetime, independent of harness signaling.
- Combination: controller best-effort + Hub sweep as backstop.
Context
Summary
PR #133 closes the in-process harness exit paths for #109 (fail-closed token revocation on intermediate stage failure). Two leak paths remain that the harness cannot cover — they require a controller-side or Hub-side janitor:
Pod killed without defers running (OOM / node loss / preemption). The harness never executes its revocation defer, so the token survives until TTL.
Intermediate success where the next stage never runs. The current stage succeeds and correctly preserves the token for the next stage, but that stage is never created (controller create failure, AgentWorkflowRun deleted between stages, etc.). No process ever revokes the token.
Both cases leave a valid Hub API token dangling until TTL expiry.
Possible approaches
Context
:bug: Fail-closed token revocation on intermediate stage failure