[antoinetoussaint-byte]

Lands the fixes stranded on fix/dependency-root-workload (head 560ed7aa, no PR, in no release) onto current main (v0.1.228, 2eef4c82), so obin-ai/module-runtime can pin a CLI that both parses installation_role and admits an excluded root with its own workload identity.

The three commits

• 0bb3c393 fix(sdk): deliver resolved workspace groups to dependency sessions — cherry-picked cleanly (here 589b13d5). GetConfiguration returned only CODEFLY__ENVIRONMENT in ProcessVariables, so a dependency SDK session (dependencies.WithDependencies) never received workspace configuration groups such as authority/endpoint. It now carries the groups resolved by the same WorkspaceConfigurationsFor a running service uses, which keeps undeclared root credentials withheld.
• 34223f47 fix(run): admit dependency clients with their own workload identity — cherry-picked with conflicts resolved against main (here cbc7d847). An --exclude-root root that declares module-identity: true is now in the launcher's authority declaration set (LocalAuthorityServices), and its credential is projected and its signed manifest admitted at the dependency barrier. It is never marked Running and publishes no endpoint. The projection reaches the SDK through GetConfiguration.ProcessVariables (DependencyProcessVariables) and reaches --output-env. Refresh ends on Stop/Shutdown.
  • Conflicts: docs/orchestration.md and the World struct in flow.go kept both sides. In excluded_root_output_env.go, main's batched, validated output-env export (ValidateModuleArtifactDelivery → outputRecords → writeOutputRecords) is kept, and its override map is now flow.DependencyProcessVariables(originService) instead of the hand-built copy. That is the one change the commit made to that function.
  • A test-only adaptation: main removed cmd/run's private workloadTokenFileVariable in favour of gitops.WorkloadTokenFileVariable, so the new TestExternalWorkloadIsAdmittedWithoutPublishingReadiness uses that constant. I amended it into the cherry-pick so every commit builds.
• 560ed7aa fix(gitops): deliver workload credential carrier for projected identities — skipped: already on main in another form. feat(delivery): a GitOps rollout delivers the signed pair through the composition interface #1240 (7b4ce84f) added gitops.WorkloadTokenFileVariable. The render now hands CODEFLY__WORKLOAD_TOKEN_FILE to the authenticating container with the mount it projects, and allows exactly that one name/value pair (projectedTokenPathEntry, holdTokenPathToItsMount). The native run uses the same constant (cmd/run/launcher.go). The commit could not land as written anyway:
  • It moves core to 130b3d169a9e, which is not on core's main (82 behind / 1 ahead of the v0.19.18 line this repo pins). That would drop installation_role parsing.
  • It relies on core's resources.WorkloadTokenFileKey classifier, which core main does not have.
  • Its one behaviour main lacks is a carrier for a workload that already mounts its own projection (provided → continue). That conflicts with main's rule that the carrier only sits beside the render's own identity-token mount. It is a deployed-render question, not part of the native admission path. If it is still wanted, it needs its own change against main's design.

Runtime admission lane: before and after

These runs use module-runtime PR #332's head (2b0c095) and python3 -I scripts/qualify-taskservice.py --suite admission with POSTGRES_BIN set to local PostgreSQL 17.

1. As PR Report authoritative repository snapshot footprint #332 stands (authority pinned at 49101ae), with both v0.1.228 and this branch, the lane fails before any CLI change matters. Authority's local host refuses runtime's manifest: field installation_role not found in type solutionhost.Authority. The authority module at 49101ae predates installation_role, so module-runtime must also move its qualification/admission authority pin. No CLI release fixes that.
2. With the authority pin moved locally to authority main a61acf94 (its local service builds on core 2aa2e9aa, which parses installation_role). This was an uncommitted change in a throwaway worktree.
   • v0.1.228 (go install github.com/codefly-dev/cli@2eef4c82): FAILED. TestLocalFixtureProfileAdmitsWithinItsClaim fails with authority/endpoint is not configured: the composition names no authority for the runtime to ask. The SDK session got no workspace groups, which is the symptom in Release the dependency-root workload fixes (fix/dependency-root-workload) on a line that parses installation_role #1248.
   • This branch (go build ./cmd/codefly at cbc7d847): PASSED. All 18 required tests passed, including TestLocalFixtureProfileAdmitsWithinItsClaim.

Checks run

• GOWORK=off GOTOOLCHAIN=auto go build ./... and go test ./... across the whole repo: passed.
• Commit 1 alone also builds and passes ./pkg/web/go-grpc.
• golangci-lint run (v2.15.0 locally; CI pins v2.14.0) on cmd/run, pkg/orchestration and pkg/web/go-grpc: 0 issues. A full ./... run reports 3 errcheck findings in cmd/terminal.go, which this PR does not touch. I did not fix them here, to keep this PR to the cherry-picks.

Reuse

This reuses Flow.WorkspaceConfigurationsFor (the running-service resolver), the launcher's existing project/hostDelivery/admitSelected admission path, and main's gitops.WorkloadTokenFileVariable carrier. It adds no second mechanism.

Classification

Fix at the owning place: the CLI's dependency-session configuration RPC and native-run admission.

Not verified

• Hosted or cell behaviour. Only the local native admission lane was run.
• module-runtime CI itself. Its lane will stay red until it pins a release containing this change and moves its authority pin.

Closes #1248

🤖 Generated with Claude Code