fix(review-swarm): make the auth gate actually validate, and fingerprint the key

[kjgbot]

Validate cloud authentication asserted only that two variables were non-empty:

test -n "$CLOUD_API_URL"
test -n "$CLOUD_API_KEY"

Today it passed on every run while agent-relay cloud run failed one step later with Workflow prepare failed: 401 Unauthorized — six PRs, repeatedly, behind a green check. A gate named for validation that tests presence is worse than no gate: it reads as cleared.

Two changes

1. Actually probe the credential against the same host the CLI uses. /api/v1/workflows/runs requires a resolved workspace and returns 401 for a fabricated or absent token — verified against production before relying on it, because an earlier attempt at this check probed /auth/whoami, which passes allowMissingWorkspace: true and therefore certifies tokens that cannot launch anything.

2. Print a non-reversible fingerprint (sha256, first 12 chars).

Why the fingerprint

There's a question I could not answer tonight. The mint proved the credential works — 200 from that same route, from a GitHub runner, 90 seconds earlier. The swarm's launch still 401'd. Production worker logs (wrangler tail) confirmed the token arriving at /workflows/prepare resolved to no api_token_sessions row at all.

Whether CI is using the credential the mint installed is unanswerable from outside, because the value is masked everywhere it appears. A fingerprint on both ends settles it in one line instead of an evening.

The error message says re-mint, don't re-run — re-running was the wrong instinct all evening. A stale credential doesn't become valid on retry.

🤖 Generated with Claude Code

https://claude.ai/code/session_01FtQSAcGDta5VH9xiZFT4sR

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 52720fbd-9f1c-43c0-a2bb-547a9b944a83

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[kjgbot]

Spec review at 1a43d2f: BLOCKED / leave open.

This serves RFC-0001 covenant 2 (check authentication before starting) and §2 rule 7 (a real review swarm, not a green vendor check). The fingerprint helps diagnose credential mismatch without printing the credential.

Blocking content finding: .github/workflows/review-swarm.yml:75-81 invokes curl without connect/total timeouts, hides curl failures behind || echo 000, and recommends credential rotation for every non-200 response, including transport failures and server errors. Bound the probe and distinguish transport/HTTP failures from 401. The existing unresolved thread discussion_r3952636976 remains valid.

The current review failure is credential infrastructure, not a content verdict. Literal command: gh run view 34163837060 --log-failed. Captured relevant output:

review	Validate cloud authentication	2026-09-07T21:38:11.3476428Z ##[error]CLOUD_API_KEY is set but not accepted by https://agentrelay.com/cloud (HTTP 401). Re***mint the credential; do not re***run this job.
review	Validate cloud authentication	2026-09-07T21:38:11.3487776Z ##[error]Process completed with exit code 1.

No gate edit performed: this workflow judges my assigned work, so settled decision #6 prohibits me from changing it. An independent gate owner must repair the probe on this PR branch; the cloud credential owner must restore accepted CI credentials and rerun at the final head. Leave open until those changes, real independent review, green CI at that head, and resolution of the outstanding thread. No merge attempted.

[github-actions]

Review swarm: maintainability

No fresh transcript was produced for run 7be45e77-ffe9-419d-b242-21ffbe2c06e5 (MISSING).

[github-actions]

Review swarm: history

No fresh transcript was produced for run 7be45e77-ffe9-419d-b242-21ffbe2c06e5 (MISSING).

[github-actions]

Review swarm: structure

No fresh transcript was produced for run 7be45e77-ffe9-419d-b242-21ffbe2c06e5 (MISSING).

[github-actions]

Review swarm: FAILED

• maintainability: MISSING
• history: MISSING
• structure: MISSING

Cloud run: 7be45e77-ffe9-419d-b242-21ffbe2c06e5

[kjgbot]

Updated spec review at d7df77c: BLOCKED / leave open.

I reread the complete updated diff. This head adds a temporary canary-secret fingerprint; it does not resolve the earlier finding. .github/workflows/review-swarm.yml:79-85 still has an unbounded curl request, folds transport failure into a status string, and tells the operator to re-mint for every non-200 response. The independent gate owner must bound the probe and distinguish credential rejection from transport/server failures on this branch. Remove temporary diagnostics when no longer needed.

This supports covenant 2 preflight but still needs the above repair. Decision #6 prevents me editing the CI review gate that judges this assignment. CI authentication recovered in a separate lane and live swarms are now running; the earlier 401 evidence is historical and cannot serve as a current content verdict. Await CI at this actual head, the independent gate repair, and resolution of the outstanding thread. No merge.

[kjgbot]

Final disposition at b9d030b: LEFT OPEN.

The latest head removes the temporary canary diagnostic seen at d7df77c; the full diff was read again. The original curl timeout/transport/non-auth error finding remains at .github/workflows/review-swarm.yml:75-81 and its thread remains unresolved. No gate edits by this reviewer (RFC decision #6). Independent gate owner must repair the probe on this branch. Latest-head review is still running; no green-CI claim. Leave open regardless of that run until the content finding is resolved.

Captured exact-head check query and output:

$ gh api repos/AgentWorkforce/flows/commits/b9d030bd5fefb3834a1c8abaad348a16934c22df/check-runs --jq '[.check_runs[] | {name,head_sha,status,conclusion,details_url}]'
[{"conclusion":null,"details_url":"https://github.com/AgentWorkforce/flows/actions/runs/34165035497/job/101874831362","head_sha":"b9d030bd5fefb3834a1c8abaad348a16934c22df","name":"review","status":"in_progress"},{"conclusion":"success","details_url":"https://www.cubic.dev/pr/AgentWorkforce/flows/pull/232","head_sha":"b9d030bd5fefb3834a1c8abaad348a16934c22df","name":"cubic · AI code reviewer","status":"completed"}]

exit_code=0

[kjgbot]

maintainability lens — FAIL

Maintainability review — PR #232, .github/workflows/review-swarm.yml

Blockers

1. "TEMPORARY canary" with no removal contract — lines 74-76

# TEMPORARY canary. Written at a known value to distinguish "secret
# writes never reach runners" from "this one secret is stuck".
echo "CANARY fingerprint: $(printf '%s' "$CLOUD_API_KEY_CANARY" | shasum -a 256 | cut -c1-12)"

No owner, no removal criterion, no linked issue, no expiry date. In six months a stranger reads "TEMPORARY" and has no way to know whether it's still diagnostic or long-since dead weight — and CLOUD_API_KEY_CANARY is now a permanent env at line 29 that every future runner receives. Either wire a removal condition (issue link, "remove after 2026-10-01", or a script that fails once the canary hash matches an expected value indicating cleanup is safe), or delete it before merge. A stale MUST is exactly the failure AGENTS.md §Observability calls out.

Concerns

2. Implicit contract with the cloud API — line 79
GET /api/v1/workflows/runs → 200 means valid is asserted in the comment ("verified against production") but not cited or pinned. If the cloud API renames the path, changes the resource to POST-only (405 with a valid token), or gates it behind a workspace header the CLI sets but curl does not, this preflight regresses to exactly the bug it's replacing: it passes while agent-relay cloud run 401s. At minimum, name the CLI version whose auth path this mirrors (11.10.3 is pinned two steps down — say so here too) and link the verification transcript. Better: probe the same endpoint the CLI's WorkflowApiKeyClient.fromEnv hits, discovered by reading its source, not guessed.

3. curl has no --max-time — lines 78-80
A hung TLS handshake blocks the job until the 75-minute cap. Add --max-time 15.

4. Comment cites a specific incident date but no artifact — lines 59-63
"on 2026-09-07 it passed on every run while agent-relay cloud run failed" is unfalsifiable in six months. Cite a PR number or run URL so a future reader can verify the story is still the reason this check exists.

Notes

• The 15-line narrative comment is on the edge of the AGENTS.md "default to no comments" rule but earns its space by explaining WHY the naive check was wrong — keep it, tighten it (drop the second paragraph, which restates what the code visibly does).
• shasum -a 256 is present on ubuntu-latest runners; safe.
• 12 hex chars (48 bits) is non-reversible; fingerprint disclosure is fine.
• Step name "Validate cloud authentication" now matches behavior — good.
• No test would fail if this preflight silently regressed to the old "presence != validity" bug, because the gate is a CI workflow with no unit coverage. Consider a shellcheck lint job or a dry-run fixture that pipes a known-bad token through the script and asserts exit 1 — otherwise this exact bug can return the next time someone "simplifies" the check.

REVIEW_FAILED

[kjgbot]

history lens — PASS

Blockers: none. PR #232 passes the HISTORY lens.

Notes

• .github/workflows/review-swarm.yml:79–86 adds a credential probe and exits unsuccessfully for every response other than HTTP 200. This supports RFC-0001’s preflight covenant and preserves failure enforcement. It does not reintroduce the session-refresh authentication removed by a1734c9 (drive: cloud run b9742721 #207) or undo the CLI installation from 99b6f61 (fix(review-swarm): install the CLI the gate runs #198).
• DRIVE-LOG’s WP-5 entries record the mistake of letting a branch’s modified review workflow judge itself. This diff changes authentication diagnostics; it leaves the main-owned review workflow checkout, verdict scripts, and aggregation rules intact. I found no newly introduced contradiction with settled decision regressions: relaycast workspace-key repair answers an untyped 500 #6.
• The substantive commit describes an HTTP probe and SHA-256 fingerprint, matching .github/workflows/review-swarm.yml:74–86. The later canary commit matches the secret binding at line 29 and diagnostic output at lines 75–77. I found no demonstrably false claim about files touched, implemented scope, or passing tests.

Concerns

• The commit’s production-verification narrative, also reflected in .github/workflows/review-swarm.yml:59–68, lacks literal commands and captured responses in the supplied diff and PR body. That limits independent assessment under the repository’s evidence standard; missing corroboration alone does not establish an untruth under this lens.
• .github/workflows/review-swarm.yml:82–84 prescribes re-minting for every non-200 response, including server failures and transport errors. That diagnostic is broader than the evidence supports, but I found no recorded, deliberately removed behavior that it reintroduces.
• The temporary canary has no documented removal condition. Track cleanup as follow-up work.

This verdict is a historical and documentary review; it does not certify live authentication or successful swarm execution.

REVIEW_PASSED

[kjgbot]

structure lens — MISSING

[kjgbot]

🎯 review-swarm: FAILED (M:fail H:pass S:missing)

Lens transcripts posted as sibling comments above.