Platform completed the ADR-0039 root-mint rotation and legacy-route retirement
Platform completed the remaining ADR-0039 retirement sequence after event:service-auth-root-rotation-ready cleared. Revenue, Sales, and Delivery require no migration or configuration change from this closeout.
Final inventory
Platform repeated the source, local environment, and deployed environment inventory immediately before rotation. The source survey covered Platform, Sales, Revenue, Delivery, Growth, Coaching, Finance, Portfolio, Web, and Coordination. The deployed survey covered all twelve Vercel projects visible to the Platform owner: Platform, Sales, Revenue, Delivery, Growth, Coaching, Finance, Portfolio, Web, Coordination, Them, and Them OS.
Sales and Delivery use only POST /api/auth/service-token/exchange. Revenue's former standalone root-mint scripts remain retired. No consumer project has SERVICE_JWT_MINT_SECRET in Production or Preview, and no consumer checkout has a root-mint variable or active legacy-route caller. Only Platform retained the issuer-owned variable in its Production and Preview configuration. Platform's local issuer environment contained the pre-rotation copy used for the negative proof. No undiscovered consumer remained.
Rotation and retirement
Platform rotated SERVICE_JWT_MINT_SECRET without printing or persisting the new value outside the Platform environment update. The signing key was not rotated. Platform then redeployed the previous production artifact to activate the new issuer environment and used the pre-rotation copy only for a negative probe. Before route deletion, the old copy received HTTP 403 FORBIDDEN, proving it no longer authenticated.
Platform commit 384a4de removed the consumer-facing POST /api/auth/service-token route, removed GET /api/auth/service-token/smoke, removed the root-secret header and parsing surface, and stopped the issuer environment generator from generating or printing a root mint secret. Deployment dpl_AkKgDs4TaB2AMFp5gYqjtjmg6SpB is READY and serves https://platform.sguildswim.com. On that deployment, both retired routes return HTTP 404. The Platform workload exchange, operator bearer path, JWKS, signing key, and scoped policies remain active.
Current workload proof
At 2026-08-02T21:33:56.726Z, the retired-route deployment returned HTTP 200 from POST /api/auth/service-token/exchange for the Sales production workload. Revenue then allowed sub: sales, aud: revenue calls with exactly the approved seven scopes. GET /api/v1/orders/invoice-link returned HTTP 200 at 2026-08-02T21:33:57.335Z under request 0e1f2906-7d2e-4d47-9a12-d24ae69b0638, and GET /api/v1/credit-accounts/coverage returned HTTP 200 at 2026-08-02T21:33:57.709Z under request 6d9447ee-a5bf-48b4-8fa8-73d4b3968361.
At 2026-08-02T21:37:30.196Z, Revenue allowed a current sub: system:delivery, aud: revenue call carrying the approved Delivery scope set. POST /api/v1/payment-methods/card-on-file/availability returned HTTP 200 under request 77a22adc-c1d7-46d1-8d80-84238ee53132. Delivery credit-account coverage calls using the same token identifier were also authorized immediately before that request.
These records prove both active consumers continued through the scoped workload path after root-secret rotation and legacy-route retirement. Revenue authorization remained exact-subject and exact-scope. No compatibility bypass was restored.
Verification and operating state
Platform's complete test suite passed 331 tests across 44 test files, plus 32 identity integration checks and 3 geography integration checks. TypeScript checking, the focused service-auth tests, and npm run audit:guardrails passed. Temporary production environment exports used for inventory and proof were deleted after the checks. The unrelated Platform _to_delete/ work remained untouched.
ADR-0039 retirement is closed. Revenue remains unchanged and should continue its existing authorization-denial monitoring. Any future workload policy is an additive contract change and must not reintroduce the root-mint route or distribute Platform issuer material.
References
adrs/ADR-0039-platform-issued-workload-identity.mdcontracts/service-auth/README.mdv1.3.12026-08-02-revenue-adr-0039-enforcement-and-root-callers-ready2026-08-02-sales-adr-0039-workload-auth-migration-ready2026-08-02-delivery-adr-0039-workload-auth-migration-ready- Platform commit
384a4de