[antoinetoussaint-byte]

Goal

WorkloadTokenFile() should state exactly which services it covers, and AGENTS.md should match what moduleauthority resolves now that #41 has merged. These are the two review notes on #41.

N1: the scope of WorkloadTokenFile()

What was wrong. The godoc, ProjectedTokenFile's godoc, the README and the CHANGELOG all said the helper names the token "wherever Codefly runs it". A native run sets CODEFLY__WORKLOAD_TOKEN_FILE only for a service that declares module-identity and does not declare workload-identity. In codefly-dev/cli, cmd/run/native_cluster.go runtimeOverrides checks peer.TokenOnly, which pkg/gitops/native_peers.go sets for exactly that case. A workload-identity service receives its token's path as TOKEN_FILE in its workload-identity configuration (renderOwnedGroups). For that service the helper falls back to /var/run/secrets/codefly/token, which does not exist under a native run.

What changed. The godoc of both WorkloadTokenFile and ProjectedTokenFile, the README paragraph and the CHANGELOG entry now state that scope. They also say what a workload-identity service does instead: it passes ProjectedTokenFile(path) with the path from its configuration. This is documentation only; behaviour is unchanged.

N2: AGENTS.md:48

What was wrong. AGENTS.md said moduleauthority "takes both seams from the consumer rather than defaulting either". That is no longer the whole picture. The seams still default no address: a zero Authority builds a mint-only client that fails with ErrNoAuthority. But the package now resolves one value itself, the projected token's path.

What changed. AGENTS.md now says which value that is: WorkloadTokenFile() reads it from the injected variable and falls back to the cell's mount. It also says the consumer opts into it, and that ProjectedTokenFile has no default.

chore(scout)

golangci-lint (errcheck) flagged an unchecked net.Conn Close in moduleauthority/broker_transport_errors_test.go, and it is now checked. golangci-lint is not a gate in this repository; CI runs build, vet, test and race. Six findings remain in packages this PR does not touch:

• datasource/operations_test.go:798 and :709 (errcheck, staticcheck QF1003)
• datasource/parity_test.go:76, :198 and :409
• internal/apiboundary/boundary_test.go:372

I left them alone to keep this PR to the review notes.

Verified

• go build ./..., go vet ./moduleauthority/ and go test ./moduleauthority/ pass.
• golangci-lint run ./moduleauthority/ (v2.14.0) reports 0 issues.
• The native-run behaviour is quoted from codefly-dev/cli main at 9794ca9 (v0.1.189 plus one commit), read from source.

Not verified

• I did not run a native run to watch a workload-identity service fall back to the pod path. The claim comes from reading the CLI source.
• I did not confirm the exact name of the environment variable the workload-identity group's TOKEN_FILE reaches a process under, so the docs name the configuration key, not a variable.

🤖 Generated with Claude Code