Fixes interface compliance after I2 added IssueSystemTokenWithTx to
the TokenService interface.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Matrix dispatcher with 14 sub-test stubs
- Suite struct with setup/cleanup lifecycle
- All sub-tests start as t.Skip stubs; filled in K2-K5
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Runs after ACP startup reaper marks stuck sessions as crashed
- mcpRepo.ReapStaleSystemTokens revokes tokens bound to crashed/exited sessions
- Single audit entry per batch: mcp.token.expire_on_restart with count + token_ids
- Errors logged but don't block boot
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Config.MCPTokensPurge + scheduleEntry branch
- app.go constructs runner with mcpTokensPurgeAdapter
- Registered as 'mcp_tokens_purge' in RunnerFns map
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Periodic delete of mcp_tokens where (expired OR revoked) before retention
- 24h interval default, 7d retention default
- Mirrors acp_events_purge pattern: idempotent, error-tolerant
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- mcpTokens dep added to Supervisor; nil-safe (test fixtures may skip)
- RevokeBySession called after audit Record in onExit
- app.go wires mcpTokenSvc (was nil placeholder)
- Integration test: fakeSupMCPTokens verifies onExit calls RevokeBySession
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- extraEnv overrides agent_kinds.encrypted_env same-name keys (spec §6.1 #11)
- Prevents admin from hard-coding ACW_MCP_TOKEN in agent_kinds
- SessionService passes nil for now; system token wiring lands in I4
- BuildSpawnEnv exported for testing the override priority
- Fix app.go NewSupervisor call to match updated signature (from I5)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Extract issueSystemToken helper; pool-bound + tx-bound entries share impl
- IssueSystemTokenWithTx accepts pgx.Tx, uses repo.WithTx(tx) for DB writes
- Audit Record stays outside tx (audit failure doesn't roll back business path)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>