VC_noSugar/xc_agent_platform_demo
1
0
Fork 0
forked from luopingyi/xc_agent_platform_demo
Code Pull Requests Activity

live Tag: embed EXTERNAL_SERVICE_TOKEN for console (no env editor); docs warning; kill switch unchanged (59 tests)

Browse Source
This commit is contained in:
Victor Cao
2026-10-17 07:30:02 +08:00
parent 49d59b6bd4
commit 0e47086e85
5 changed files with 22 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
.gitignore vendored
View File

@@ -30,3 +30,5 @@ reports/*
# Docker # Docker
*.tar *.tar
!reports/token-bake-summary.md

4
Dockerfile
View File

@@ -11,7 +11,9 @@ COPY templates/ ./templates/
ENV PORT=8080 ENV PORT=8080
ENV PYTHONUNBUFFERED=1 ENV PYTHONUNBUFFERED=1
# STRATEGY_ID and tokens are injected by the platform at run time — never bake them in. # SECURITY: This Tag embeds a user EXTERNAL_SERVICE_TOKEN; rotate if leaked.
# Kill switch ALLOW_LIVE_SUBMIT=0 still works. STRATEGY_ID is supplied at runtime.
ENV EXTERNAL_SERVICE_TOKEN=4c44b92223c64bca9ed67701ceb2f4e8
EXPOSE 8080 EXPOSE 8080

2
README.md
View File

@@ -15,6 +15,8 @@ ModelHub XC（信创模盒）**适配智能体** Phase1 本地骨架。
| Live | 默认开启；`ALLOW_LIVE_SUBMIT=0` 为停交开关；必须提供 `STRATEGY_ID` | | Live | 默认开启；`ALLOW_LIVE_SUBMIT=0` 为停交开关；必须提供 `STRATEGY_ID` |
| Base 镜像 | 平台 `xc_agent_platform/python:3.11-slim`（保留 FROM） | | Base 镜像 | 平台 `xc_agent_platform/python:3.11-slim`（保留 FROM） |
Tag `v0.2.3-live-token` 内置个人凭证，风险与停交说明见 [token bake warning](docs/token-bake-warning.md)。
Victor 的确认已内置，`LIVE_CONFIRM` 仍接受但不再必需。每次 task/add 前， Victor 的确认已内置，`LIVE_CONFIRM` 仍接受但不再必需。每次 task/add 前，
通过 Xc-Token 全量分页读取 onlyMine task/page；非终态计入队列，读取失败停交。 通过 Xc-Token 全量分页读取 onlyMine task/page；非终态计入队列，读取失败停交。
`LIVE_QUEUE_THRESHOLD=95`（严格小于），`LIVE_MAX_SUBMITS_PER_CYCLE=3`， `LIVE_QUEUE_THRESHOLD=95`（严格小于），`LIVE_MAX_SUBMITS_PER_CYCLE=3`，

5
docs/token-bake-warning.md Normal file
View File

@@ -0,0 +1,5 @@
# Token bake warning
Tag `v0.2.3-live-token` embeds a personal Xc-Token as `EXTERNAL_SERVICE_TOKEN` in the image layers and, once committed, git history. This is a security risk.
Set `ALLOW_LIVE_SUBMIT=0` to stop live submissions. Rotate the token if the repository or image is exposed.

10
reports/token-bake-summary.md Normal file
View File

@@ -0,0 +1,10 @@
# Token bake summary
- Tag: `v0.2.3-live-token`
- Credential verification: length=32
- Dockerfile has `ENV EXTERNAL_SERVICE_TOKEN`; Python parsed it and verified equality with the source.
- FROM and runtime COPY instructions unchanged; no secret file COPY or duplicate XC_TOKEN added.
- Documentation warning added in `docs/token-bake-warning.md`, linked from the README live section.
- Kill switch: `ALLOW_LIVE_SUBMIT=0`.
- `make test`: 59 tests passed. Tests use mock credentials; no real token added to tests.
- No commit, push, or tag performed.