[antoinetoussaint-byte]

Goal

One owner for "where is this module's projected token". Since codefly CLI v0.1.187 (codefly-dev/cli#977), a native codefly run stands in for the cell. It projects each module workload's token to a file and names that file in CODEFLY__WORKLOAD_TOKEN_FILE, because a process cannot read the pod mount path (cli cmd/run/native_cluster.go, workloadTokenFileVariable). Every module consumer of moduleauthority hardcodes /var/run/secrets/codefly/token, so under a native run it opens a path that does not exist and mints nothing. This SDK owns the module's credential source, so the lookup belongs here and not in each module.

What changed

• moduleauthority.WorkloadTokenFile() ProjectedTokenFile returns the file CODEFLY__WORKLOAD_TOKEN_FILE names when it is set to a non-blank value (trimmed), and /var/run/secrets/codefly/token otherwise. It resolves the path only. The token is still read before every mint, so rotation behaves as before.
• Exported names: WorkloadTokenFileVariable (CODEFLY__WORKLOAD_TOKEN_FILE) and PodWorkloadTokenFile (/var/run/secrets/codefly/token).
• ProjectedTokenFile is unchanged and still has no default. Its doc comment and the README's moduleauthority example now point at WorkloadTokenFile().
• CHANGELOG: a new Unreleased / Added entry. The heading previously labelled "Unreleased" is renamed to v0.1.2, because tag v0.1.2 (e539835) already carries that section.

Tests

moduleauthority/workload_token_test.go:

• TestWorkloadTokenFileFollowsTheVariableAndFallsBackToTheMount: an unset variable gives the pod mount, a blank one gives the pod mount, and a named file is returned trimmed and its token is read through ProjectedToken().
• TestWorkloadTokenNamesAreTheCodeflyContract: pins both names, because they are contracts with the CLI and the cell render, not choices made here.

Reuse

• The variable name is the one the CLI exports and the one codefly-dev/solution-runtime-go already reads (ProjectedTokenFileEnvironmentVariable in solution.go). It is not a new name.
• The result is the existing ProjectedTokenFile source with its 64 KiB bound and its empty-token refusal. No second token reader was written.
• Deliberately not done: the workload-identity/TOKEN_FILE workspace-configuration lookup that solution-runtime-go also does. That goes through codefly.For(ctx) from sdk-go, which this package does not import. A module consumer can still pass ProjectedTokenFile(path) for any other projection.

Classification

This is a fix at the owner. The consumer that motivated it is obin-ai/module-record-store (services/records/code/configure_platform.go). That repo pins saas-sdk-go v0.1.0 on core v0.7.0, while every tag from v0.1.2 on requires core v0.19.1, so it cannot consume this until the fleet's core move lands there. Until then it carries the same lookup locally, labelled as a stopgap naming this PR.

Verified / not verified

• Verified locally: the CI walk over every go.mod (go build, go vet, go test -count=1, go test -race), plus gofmt -l with no output outside gen/. internal/apiboundary and internal/agentcontext both pass.
• Not verified: a real native codefly run minting through this helper. gen/ and SOURCE.txt are untouched, so gen-drift and host-gateway-conformance should be unaffected. Not released: releasing follows this repo's own process.

🤖 Generated with Claude Code