Delivery Revenue workload migration exposed one remaining Platform-audience root-secret caller

Revenue migration status

Delivery has migrated its ordinary Revenue clients to the production workload exchange published in service-auth v1.0.0. The client requests the exact custom Vercel OIDC audience, exchanges the proof at Platform, validates the fixed Delivery-to-Revenue claims and scope set, caches the five-minute Platform token in process memory, coalesces refreshes, and fails closed when no valid token is available.

Delivery also removed root-secret minting from its Revenue repair and backfill tooling. One-shot Revenue tools now require a short-lived token from Platform's operator command.

Remaining root-secret caller

The whole-repository audit found a separate caller outside the initial Delivery-to-Revenue policy. lib/platform/comms-routing.ts calls Platform's guardian-aware identity comms-routing endpoint with aud: platform. It still uses the legacy root mint route when no explicit identity bearer exists.

Service-auth v1.0.0 fixes the workload exchange output to aud: revenue. Sending that token to Platform identity would violate audience separation. Removing MintSecret from Delivery now would instead make guardian-aware survey routing fail because Delivery has no production PLATFORM_IDENTITY_BEARER.

Delivery will therefore keep the existing root secret only until this one Platform-audience path has a policy-bound replacement. No Revenue path uses it after the migration.

Platform ask

Platform, please publish the smallest additive service-auth policy for the existing Delivery production workload to call the comms-routing read. The preferred shape is a Platform-audience token with:

• sub: system:delivery
• aud: platform
• tenant_id: tnt_sguild
• the same canonical Organization reach
• one exact operation scope for guardian-aware comms-routing reads
• the same five-minute maximum lifetime and audit requirements

Platform may name the exact scope in the contract. A broad Platform read scope or reuse of the Revenue token is not acceptable.

Please reply with the endpoint or capability selector and the contract version. After it is live, Delivery will migrate comms-routing.ts, remove the final root-secret read, remove MintSecret from Delivery environments, and declare delivery-workload-auth-migration-ready.

Evidence

• Delivery implementation commit: 1937a268b697d523ce9747075fbbd90b7dfe418e
• Delivery production deployment: dpl_62K4gHrZpoTcZSDaurgEgW9ZCyng, READY
• Signed-in production Workbench load: HTTP 200 with Revenue credit and payment availability data
• Platform production exchange: one HTTP 200 issuance for the Workbench load
• Revenue production authorization: HTTP 200 for credit coverage, open order, and card-on-file availability reads under system:delivery
• Shared contract: contracts/service-auth/README.md v1.0.0
• Platform readiness memo: 2026-07-30-platform-adr-0039-exchange-live
• Remaining caller: Delivery lib/platform/comms-routing.ts