git-remote-entire: migrate the ENTIRE_TOKEN (CI) path to jurisdiction tokens

[toothbrush]

Stacked on #1621. Fixes COR-847.

Why

The ENTIRE_TOKEN (CI / Buildkite) path was the last client of the repo-scoped exchange, paying it per (repo, action) on every git command — that's also happening in CI.

What

• resolveEnvTokenCreds now mints a jurisdiction access token instead of building a repocreds.Cache: audience = the cluster's advertised jurisdiction_audience, exchanged at the core derived from the token's aud claim (unchanged trust gate against the cluster's advertised core set). A cluster advertising no jurisdiction_audience fails closed with the same upgrade hint as the interactive path (shared missingJurisdictionAudienceErr).
• The env flavour pins the exchange core (sa-session JWTs carry no home_jurisdiction claim to route by) and never touches the OS keychain — in-process memo only; Invalidate() (the 401 observer) drops just the memo.
• Both paths now return *jurisdictionTokenSource, so the tokenSource interface, the repocreds dependency in git-remote-entire, and the unused clusterBaseURL plumbing are gone. Token() drops its ignored (repo, action) params; the smart-HTTP endpoint classification stays as the credential-attachment gate.
• clusterdiscovery.ResolveClusterCores returns the full discovery entry and adopts the audience-requiring cache semantics (pre-audience entries refetched, no audience-less stale fallback) — its sole caller is now audience-requiring.

Verified server-side that the exchange gates hold for CI subjects: sa-session tokens carry LoginScopes ⊇ entire:session (passes validateIdentityExchange), have aud == iss, and are explicitly carved out of the fid-liveness gate. No entiredb change needed.

Follow-up

• Sunset validateRepoExchange server-side once nothing mints repo-scoped tokens (needs a released helper + bumped Buildkite plugin pin).

Tests

• go test ./... green; new tests: env source pins the token's core, mints in-memory only (no token-store writes, memo-only Invalidate), missing jurisdiction_audience fails closed.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes authentication for all CI git operations and removes the repo-scoped fallback; clusters without jurisdiction_audience will fail until upgraded, but the existing ENTIRE_TOKEN trust gate and fail-closed behavior are preserved.

Overview
CI / ENTIRE_TOKEN auth now uses jurisdiction access tokens instead of per-(repo, action) repo-scoped exchanges, so Buildkite-style runners pay one exchange per process (memoized) rather than on every git command.

resolveEnvTokenCreds builds newEnvJurisdictionTokenSource: exchange at the trust-gated core from the token’s aud, audience from cluster jurisdiction_audience, pinned core (no home_jurisdiction on sa-session JWTs), and no OS keychain—only in-process cache; Invalidate on 401 clears the memo only. Missing jurisdiction_audience fails closed via shared missingJurisdictionAudienceErr (no repo-scoped fallback).

Both interactive and env paths return *jurisdictionTokenSource; repocreds and tokenSource are removed, Token(ctx) no longer takes repo/action (smart-HTTP classification still gates where Bearer is attached). ResolveClusterCores returns the full discovery entry and uses audience-required cache semantics for the env path.

Tests cover pinned core routing, in-memory-only env minting, and missing-audience rejection.

^{Reviewed by Cursor Bugbot for commit 17b1dcd. Configure here.}

[Copilot]

Pull request overview

This PR migrates the ENTIRE_TOKEN (CI / workload identity) authentication path in git-remote-entire from per-(repo,action) repo-scoped token exchange to jurisdiction identity tokens, aligning it with the interactive auth model and removing the hot-path exchange cost in CI.

Changes:

• Switch the env-token (ENTIRE_TOKEN) flow to mint jurisdiction identity tokens (in-process memo only; no keychain).
• Simplify the credential plumbing by removing the tokenSource abstraction and dropping unused repo-scoped parameters.
• Extend cluster discovery to return the full discovery entry (cores + jurisdiction audience/core) for the env-token trust gate.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
internal/entireclient/clusterdiscovery/resolve.go	Updates ResolveClusterCores to return the full discovery entry needed by the env-token path.
cmd/git-remote-entire/main.go	Migrates env-token auth to identity tokens, removes repo-scoped plumbing, and adjusts credential attachment gating.
cmd/git-remote-entire/main_test.go	Updates the well-known stub and adds tests validating env-token identity token behavior and fail-closed upgrade hint.
cmd/git-remote-entire/identityauth.go	Adds the env-token identity-token source variant (pinned core, no persistence) and updates token acquisition API.
cmd/git-remote-entire/identityauth_test.go	Updates call sites for the new Token(ctx) signature and adds coverage for the env pinned-core path and non-persistence.

[toothbrush]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 17b1dcd. Configure here.}