decisions: 108, Q105 A, subscription token as a read-only file secret (I1-4)

Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-12 10:00:59 -05:00
parent de64f01c39
commit 7c3a8ad841
1 changed files with 25 additions and 0 deletions
@@ -2388,3 +2388,28 @@ which stay with him. Each item names who decided it and what happened.
    - It reopens only as a new question to Jason, after the containers
      run and the actions that need it are known. Nobody adds it to a
      brief before then.
+108. **Q105 A: the subscription token as a read-only file secret, I1-4
+    (2026-10-12).** Jason, relayed by Mos (sage-0078, recorded in
+    jason-master-restart DECISIONS.md): "Q105: A". Q105 offered (A) the
+    subscription token as a read-only file secret, or (B) an API key
+    behind a key-holding gateway. Before he answered, Mos corrected the
+    question: egress goes through the one proxy to the approved provider
+    hosts, not only Anthropic's.
+    - Containerized managed sessions get `CLAUDE_CODE_OAUTH_TOKEN` from
+      a file secret mounted read-only into each session container. It
+      never goes in the container config, compose environment or image.
+      There is no API key, no gateway and no new spend.
+    - Jason accepts that an agent in the container can read the token
+      and copy it out. The egress allowlist is what limits where it can
+      go. The instance workspace is mounted read-write, so a copy can
+      also land on the host disk. The brief says so.
+    - Design items for the brief, Sage's to settle: how the token
+      reaches the Claude CLI from the file without going into the
+      container config (the runner reads it and passes it to the
+      adapter's process only), and file ownership under the rootless
+      subuid mapping (decision 106).
+    - Moving to B later costs money, so it goes back to Jason.
+    - With decisions 105 to 108, all four I1 items are answered. The I1
+      brief is Sage's to write. M1 is decision 104. Under decision 96,
+      when T3 Mos retires is still Jason's call after the M3 trial, and
+      nobody puts it to him before then.