Bind a worker's name and labels into its token; list and revoke tokens by jti

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ

backend/fluksio/core/security.py

@@ -132,13 +132,19 @@ def create_oauth_access_token(
     )
 
 
-def create_worker_token(name: str, expires_delta: timedelta) -> str:
+def create_worker_token(
+    name: str,
+    expires_delta: timedelta,
+    labels: list[str] | None = None,
+    jti: str | None = None,
+) -> str:
     """A credential a remote worker presents when it dials in.
 
-    Signed with the same keypair the agent tokens use, so the whole set can be
-    revoked by rotating one key, and told apart from them by its audience: a
-    worker's token grants no API access, and an agent's opens no worker
-    connection.
+    Signed with the same keypair the agent tokens use, and told apart from them
+    by its audience: a worker's token grants no API access, and an agent's
+    opens no worker connection. It names the worker and the labels it may
+    carry, so a worker cannot claim work meant for another machine, and its
+    `jti` is what revoking one token rather than the whole key goes by.
     """
     now = datetime.now(UTC)
     payload = {
@@ -148,6 +154,8 @@ def create_worker_token(name: str, expires_delta: timedelta) -> str:
         "iat": now,
         "exp": now + expires_delta,
         "scope": WORKER_SCOPE,
+        "labels": sorted(set(labels or [])),
+        "jti": jti or uuid.uuid4().hex,
     }
     return jwt.encode(
         payload,