Bind a worker's name and labels into its token; list and revoke tokens by jti

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013GAeg4Jo6xjZzjwy9QDWMQ
2026-10-07 08:42:14 +02:00
parent 71b0f986e9
commit 21537e2eb6
16 changed files with 470 additions and 38 deletions
@@ -16,7 +16,8 @@ fluksio-worker \

 `--python` is the interpreter node code runs on, which is how this machine keeps
 its own wheels without the engine ever installing them. Mint a token from the
-engine with `POST /api/v1/workers/tokens`.
+engine with `POST /api/v1/workers/tokens`; it carries this worker's name and
+labels, and `--labels` may repeat those but not change them.

 A plain `ws://` address is refused unless the engine is on this machine, since
 the token and node secrets would cross the network in clear; `--insecure`