From fcfb0f3caecacd8bea6a57473b91d7407065a672 Mon Sep 17 00:00:00 2001
From: mintaka <mintaka@rigel.build>
Date: Mon, 24 Aug 2026 10:25:06 -0400
Subject: [PATCH] fix(devenv): single-source the dogfood runner-id so mint and
 runner never drift (RIG-2660)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The dogfood loop minted the runner token with a hardcoded runner-id and launched compass-runner with the same literal in two separate places. The runner's Enroll cross-checks the token subject against its --runner-id, so any drift between the two copies is rejected unauthenticated at enroll — and a deployment overlay that overrides one but not the other silently breaks enrollment on every DB recreate (the live mattfw box runs a different runner-id and needs a manual re-mint each recreate).

Introduce one dogfoodRunnerID binding in the let block (mirroring dogfoodDSN) that both the mint task and the runner process reference, so they move in lockstep and an overlay overrides the subject in exactly one place.

Refs RIG-2660

Co-authored-by: Matt Wilkinson <matt@rigel.build>
---
 devenv.nix | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/devenv.nix b/devenv.nix
index fca2b94d..495aa375 100644
--- a/devenv.nix
+++ b/devenv.nix
@@ -20,6 +20,14 @@ let
   # database, surfacing only as a runner enroll failure.
   dogfoodDSN = "host=${config.env.PGHOST} port=${toString config.env.PGPORT} dbname=compass sslmode=disable";
 
+  # Runner id (enrollment subject) shared by dogfood:mint-runner-token and the
+  # compass-runner process. The runner's Enroll cross-checks the token subject
+  # against its --runner-id, so mint and runner MUST agree or enroll is rejected
+  # `unauthenticated` — both consumers reference one binding rather than a pair
+  # of copies that could silently drift. An overlay that overrides the runner id
+  # sets it here once and both consumers move in lockstep.
+  dogfoodRunnerID = "dogfood";
+
   # The go pin (tools/toolchain/versions/go.nix), version-selected from the
   # go-overlay input. go-overlay's flake exposes each version as a package attr
   # named `go_<major>_<minor>_<patch>` (dots→underscores; nix attr names hold no
@@ -443,7 +451,7 @@ in
         go build -o "$bin" ./cmd/compass-runner
         export COMPASS_RUNNER_TOKEN="$(cat "${config.devenv.state}/compass/runner.token")"
         exec "$bin" \
-          --runner-id dogfood \
+          --runner-id ${dogfoodRunnerID} \
           --server "https://127.0.0.1:${toString config.processes.compass-server.ports.network.value}" \
           --ca "${config.devenv.state}/compass/tls.crt" \
           --image compass-agent:latest \
@@ -492,7 +500,7 @@ in
         bin="${config.devenv.state}/compass/compass-mint-runner-token"
         go build -o "$bin" ./cmd/compass-mint-runner-token
         exec "$bin" \
-          --runner-id dogfood \
+          --runner-id ${dogfoodRunnerID} \
           --token-out "${config.devenv.state}/compass/runner.token"
       '';
       cwd = "${config.devenv.root}/go";