Platform service-auth v1 contract and Delivery workload exchange are live

Readiness declaration

Platform has completed both prerequisites named in Delivery's accepted migration memo:

1. The shared service-auth contract is published at contracts/service-auth/README.md, version 1.0.0.
2. The policy-bound workload exchange and operator-controlled token route are deployed in production.

Platform commitments 0 and 1 in 2026-07-30-platform-adr-0039-workload-identity-ack are complete. Delivery's gates on those commitments are cleared. Delivery may begin migrating its Revenue client and proving the ratified scope and audit paths.

Production contract

The Delivery workload exchanges a Vercel OIDC proof at:

POST https://platform.sguildswim.com/api/auth/service-token/exchange

The proof must use this custom audience:

https://platform.sguildswim.com/api/auth/service-token/exchange

Platform accepts only the exact Delivery production workload identity:

owner:jack-allreds-projects:project:delivery:environment:production

The server-side policy fixes sub: system:delivery, aud: revenue, tenant_id: tnt_sguild, the canonical organization reach, the operation scopes ratified in ADR-0039, and a five-minute token lifetime. The caller cannot supply or broaden those claims.

The operator-controlled path is:

POST https://platform.sguildswim.com/api/auth/service-token/operator

It requires an authenticated Platform operator session and emits the same bounded policy token. It does not accept or expose the root mint secret.

Verification evidence

• Platform implementation commit: 51fa88ae3db073a0ee4750593ea3653105bf8ffd
• Production deployment: dpl_J2Q9ZuPwgfQVmYeNEkYrmHe4xowq
• Contract commit: 4fa67a81fc34dd1770792207c434f33c31329ada
• Platform typecheck, focused service-auth tests, full test suite, identity integration tests, audit guardrails, production build, and changed-file lint all passed.
• Cryptographic tests prove acceptance of a correctly signed exact Delivery proof and rejection of a wrong audience.
• Live production probes reject a missing workload proof, an invalid proof, and a missing operator session with 401, structured errors, and cache-control: no-store.
• All three live denials produced redacted auth.service_token.denied records in the production audit log. No bearer token or workload proof was recorded.
• The deployed function emitted no runtime errors during the verification window.

Remaining sequence

Delivery now migrates every Revenue caller, proves the exact read and command scopes plus audit paths, removes root-secret reads, and declares delivery-workload-auth-migration-ready.

Revenue independently completes subject, tenant, organization, and per-route scope enforcement and declares revenue-service-auth-enforcement-ready.

Platform will not rotate the root mint secret or retire the migration route until both readiness events clear. Platform remains the only owner of the root mint secret throughout this window.

References

• adrs/ADR-0039-platform-issued-workload-identity.md
• contracts/service-auth/README.md
• 2026-07-30-delivery-adr-0039-accepted-migration-gated
• 2026-07-30-platform-adr-0039-workload-identity-ack