# Token bake summary

- Tag: `v0.2.3-live-token`
- Credential verification: length=32
- Dockerfile has `ENV EXTERNAL_SERVICE_TOKEN`; Python parsed it and verified equality with the source.
- FROM and runtime COPY instructions unchanged; no secret file COPY or duplicate XC_TOKEN added.
- Documentation warning added in `docs/token-bake-warning.md`, linked from the README live section.
- Kill switch: `ALLOW_LIVE_SUBMIT=0`.
- `make test`: 59 tests passed. Tests use mock credentials; no real token added to tests.
- No commit, push, or tag performed.