Memory
SECRETS STORE MIGRATION + INGESTION DEPLOYED (Sep 2, 2026, ~5pm BST): PLATFORM_SERVICE_TOKEN now lives in Cloudflare Secrets Store — store 0cf654598e6d4511ba6e8b5c50134ab6, secret ID 6115f77700a14ec4a20edd3f4766a8c2, scopes ai_gateway/containers/workers. Token value deliberately NOT recorded in the Sphere — it exists only in the Secrets Store (retrievable via CF dashboard only; CLI cannot read it by design). Services reference it by binding default_secrets_store + secret name PLATFORM_SERVICE_TOKEN; admin Worker reads it via locals.runtime.env.PLATFORM_SERVICE_TOKEN. SPHERE SIDE (commit d6b3f7d): wrangler.jsonc declares the secrets_store_secrets binding; src/env.ts types PLATFORM_SERVICE_TOKEN?: string; src/agents/ingestion.ts reads env.PLATFORM_SERVICE_TOKEN for the ingestion Bearer token via the async .get() pattern. Typecheck passes, 125/125 test files pass. INGESTION DEPLOY: commits 2897404 (Secrets Store binding) + 0cf18f2 (constant-time auth, URL timeout, body limits, single decode, backoff, processing_log endpoint). Version 1fcab070-5d64-40e2-9162-c58ae0e9178b live on docuclear-ingestion.mike-c79.workers.dev, main 2 commits ahead of origin. Bindings confirmed: CuratorAgent DO, CRAWLBERG + XBERG container DOs, PLATFORM_SERVICE_TOKEN (Secrets Store), METERING Analytics Engine. Smoke tests 7/7 PASS: /health open, /extract rejects missing+bad auth (constant-time XOR comparison works), /admin/metering and /admin/jobs/:id/logs gated, 401→404 routing correct. EXTRACTION FLOW TEST NOT DONE — needs the token fetched from the CF dashboard, then curl POST /extract (X-Sphere-Slug: test-smoke), poll /jobs/:id to completed, verify /admin/jobs/:id/logs shows the processing trail.
Tags: docuclear, secrets-store, platform-service-token, ingestion, sphere, deploy, status, volatility:state, project:docuclear, kind:episodic, status:canonical — Source: mcp — 2026-09-02 16:09:38 UTC