Delivery workload authentication migration is production-ready and clears the ADR-0039 Delivery gate

Delivery clears event:delivery-workload-auth-migration-ready.

Production result

Delivery migrated lib/platform/comms-routing.ts to the Platform workload exchange and removed its final root-mint-secret path. Production now exchanges Vercel OIDC for the exact Platform policy delivery-production-to-platform-comms-routing-v1, then presents a five-minute token with sub: system:delivery, aud: platform, tenant tnt_sguild, the canonical Sguild organization, and only platform.identity.comms-routing.read.

The migration landed in Delivery commit 8b2fa05. Commit 5c60bf7 added parsing for Platform's canonical nested recipient envelope. The temporary proof route was removed in commit cadab47 after verification.

The no-MintSecret proof deployment dpl_DBGE2rcuZKT87RpGFBKfKgyzQpQB returned HTTP 200 from a canonical production comms-routing read at 2026-08-02T17:22:52Z. Platform's production audit row for the same issuance records event auth.service_token.issued, actor kind SYSTEM, the exact policy, subject, audience, tenant, organization, and scope above, plus a JTI and integer issuance bounds.

The route-removal artifact is commit cadab47, deployed as dpl_Dg9We6ThExyUKbvWT3Yv4nZkBjfD. It reached READY with no runtime error clusters or error-level logs in the verification window. The current production deployment is downstream commit b1ef045, deployed as dpl_9KzVdzH5nux7H9cnqQF6MW3BoqMk; it retains the route removal and owns delivery.sguildswim.com.

Secret retirement and verification

MintSecret is absent from Delivery's Vercel Production and Preview environments. The local Delivery environment no longer contains MintSecret or SERVICE_JWT_MINT_SECRET. Production and non-production code fail closed; production does not accept a static bearer fallback.

Final verification passed 561 tests with one skipped integration fixture, eight lock-audit tests, TypeScript typechecking, and the runtime smoke suite. Focused workload-auth and comms-routing coverage includes exact claim validation, fail-closed behavior, token caching and coalescing, and the canonical nested response envelope.

During verification, a verbose CLI path exposed the cron credential and one deployment-protection automation credential in local tool output. Delivery rotated CRON_SECRET for Production and Preview, regenerated the exposed automation bypass credential, stopped using that CLI path, and completed the proof without logging identifiers or credentials.

Remaining gate

Platform root-secret rotation remains gated on the independent event:revenue-service-auth-enforcement-ready. This memo clears only Delivery's half of the service-auth-root-rotation-ready all-of event.

References

• adrs/ADR-0039-platform-issued-workload-identity.md
• 2026-07-30-delivery-adr-0039-accepted-migration-gated
• 2026-07-30-delivery-adr-0039-platform-audience-gap
• 2026-08-01-platform-adr-0039-platform-audience-policy-live