anthropic-bed: prove model-access refreshes on the manager node

A lab bed for Phase C of model-access (ADR 0050), OAuth endpoint stubbed. It drives the real runtime images through the whole flow: the manager seals a refresh token at rest and opens it on the manager node alone, mesh-control is handed only the access token and an opaque re-sealed envelope via licence submit-refresh, and the consumer writes an access-token-only credential. Asserts the refresh token -- original and rotated -- is nowhere on the consuming node and only ciphertext in the control plane's database. build-module-runtime.sh also compiles adopt/refresh/apply/usage entrypoints. Stubbed and flagged: the vendor endpoint, the manager node's private key (mounted; a host capability to deliver it does not exist today), and the submit transport (the test invokes the CLI on the manager's output). Claude-Session: https://claude.ai/code/session_01LrgweAeERJYBg88c5cKDzF
2026-09-07 01:00:37 +02:00
parent 0a132aa00e
commit 6be5072565
3 changed files with 446 additions and 2 deletions
@@ -0,0 +1,45 @@
+# One machine that becomes a mesh, then plays out the whole model-access refreshable-grant flow for
+# Anthropic (novox/hq ADR 0050, Phase C) with the vendor's OAuth endpoint STUBBED — no real Anthropic
+# is reached. The bed proves the one property the carve-out rests on: the refresh token is opened only
+# on the manager node, the control plane seals and delivers only the ACCESS token, and a consuming
+# node writes an access-token-only credential and is never given a refresh token.
+#
+# The flow the test drives (OAuth stubbed, so it is the FLOW that is proven, not the vendor):
+#   manager opens the at-rest envelope on the manager node  ->  calls the stub token endpoint  ->
+#   submits back only { access token, re-sealed refresh envelope }  ->  mesh-control seals the access
+#   token per holder  ->  the consumer runtime writes ~/.claude/.credentials.json, access-token-only.
+#
+#   MESH_LAB_HOST_BINARY=.../mesh-host   MESH_LAB_BUNDLE=.../examples/substrate-first-node.lock
+#   Build BOTH runtime images into the local daemon first (the scenario stocks and serves them by
+#   digest, which is where the host pulls them from):
+#     scripts/build-module-runtime.sh anthropic-manager  /tmp/anthropic-manager.tar
+#     scripts/build-module-runtime.sh anthropic-consumer  /tmp/anthropic-consumer.tar
+#   (the tar output is incidental — the build also tags the image into the local docker daemon, which
+#   is what raise() stocks.) The stub OAuth endpoint is a tiny node server the test runs from the
+#   manager runtime image itself, so no extra image is needed.
+scenario: anthropic-bed
+
+segments:
+  hosting:
+    kind: public
+    cidr: [192.0.2.0/24]
+
+machines:
+  anchor:
+    at: { segment: hosting, address: [192.0.2.10] }
+    inbound: allow
+    memory: 3GiB
+    cpus: 2
+
+images:
+  # The first-node substrate: store, broker, control.
+  - postgres:17-alpine
+  - cloudamqp/lavinmq:latest
+  - mesh-control:development
+  # The two model-access runtimes, built by scripts/build-module-runtime.sh into the local daemon and
+  # stocked into the scenario's own registry, which is where the host pulls them from.
+  - mesh-runtime-anthropic-manager:development
+  - mesh-runtime-anthropic-consumer:development
+
+place:
+  all: [host, runtime]