live Tag: embed EXTERNAL_SERVICE_TOKEN for console (no env editor); docs warning; kill switch unchanged (59 tests)

.gitignore

@@ -30,3 +30,5 @@ reports/*
 
 # Docker
 *.tar
+
+!reports/token-bake-summary.md

Dockerfile

@@ -11,7 +11,9 @@ COPY templates/ ./templates/
 
 ENV PORT=8080
 ENV PYTHONUNBUFFERED=1
-# STRATEGY_ID and tokens are injected by the platform at run time — never bake them in.
+# SECURITY: This Tag embeds a user EXTERNAL_SERVICE_TOKEN; rotate if leaked.
+# Kill switch ALLOW_LIVE_SUBMIT=0 still works. STRATEGY_ID is supplied at runtime.
+ENV EXTERNAL_SERVICE_TOKEN=4c44b92223c64bca9ed67701ceb2f4e8
 
 EXPOSE 8080
 

README.md

@@ -15,6 +15,8 @@ ModelHub XC（信创模盒）**适配智能体** Phase1 本地骨架。
 | Live | 默认开启；`ALLOW_LIVE_SUBMIT=0` 为停交开关；必须提供 `STRATEGY_ID` |
 | Base 镜像 | 平台 `xc_agent_platform/python:3.11-slim`（保留 FROM） |
 
+Tag `v0.2.3-live-token` 内置个人凭证，风险与停交说明见 [token bake warning](docs/token-bake-warning.md)。
+
 Victor 的确认已内置，`LIVE_CONFIRM` 仍接受但不再必需。每次 task/add 前，
 通过 Xc-Token 全量分页读取 onlyMine task/page；非终态计入队列，读取失败停交。
 `LIVE_QUEUE_THRESHOLD=95`（严格小于），`LIVE_MAX_SUBMITS_PER_CYCLE=3`，

docs/token-bake-warning.md

@@ -0,0 +1,5 @@
+# Token bake warning
+
+Tag `v0.2.3-live-token` embeds a personal Xc-Token as `EXTERNAL_SERVICE_TOKEN` in the image layers and, once committed, git history. This is a security risk.
+
+Set `ALLOW_LIVE_SUBMIT=0` to stop live submissions. Rotate the token if the repository or image is exposed.

reports/token-bake-summary.md

@@ -0,0 +1,10 @@
+# Token bake summary
+
+- Tag: `v0.2.3-live-token`
+- Credential verification: length=32
+- Dockerfile has `ENV EXTERNAL_SERVICE_TOKEN`; Python parsed it and verified equality with the source.
+- FROM and runtime COPY instructions unchanged; no secret file COPY or duplicate XC_TOKEN added.
+- Documentation warning added in `docs/token-bake-warning.md`, linked from the README live section.
+- Kill switch: `ALLOW_LIVE_SUBMIT=0`.
+- `make test`: 59 tests passed. Tests use mock credentials; no real token added to tests.
+- No commit, push, or tag performed.