> **Relayed** to mgf-cloud-provision#PAPER-01 by the supervisor (FB-05).

### PAPER — `ops/agent-reconciler.py`: mint the Woodpecker JWT per-run (static token rots silently)

- **Severity:** 🟡 Sharp edge (proven 17-day silent outage of the CI safety net)
- **Filed by:** mgf-standard (PAPER-111 investigation) on 2026-07-10
- **What hurts:** the deployed reconciler reads a **static** JWT from
  `/opt/woodpecker/reconciler.token`. Woodpecker user JWTs are HS256-signed
  with the user's DB `hash` as the key — any hash rotation invalidates every
  previously-minted token. Observed: the token 401'd from 2026-06-23 to
  2026-07-10 (~1,950 `api error` runs), so the fleet's wedge-recovery net was
  down for ~2.5 weeks and the 2026-07-01 wedge (mgf-standard PAPER-111)
  outlived it. Repaired 2026-07-10 by re-minting on-host — but the next hash
  rotation re-creates the outage.
- **Why it matters:** the reconciler is the recovery path for the single most
  critical shared resource (CI capacity), and its failure mode is silent.
- **Evidence:** `/var/log/woodpecker-reconciler.log` (`api error` from
  2026-06-23T20:36Z; recoveries 2026-06-21/22 before it); fresh on-host mint →
  `GET /api/queue/info` 200; mint math = `mgf` workspace
  `tools/woodpecker_api.sh` (proven byte-identical to Woodpecker's own by
  `rotate_woodpecker_token.sh --check`).
- **Suggested shape:** the reconciler runs as root on the server host — have it
  mint per-run exactly like `woodpecker_api.sh` (read `id|hash` from the
  `woodpecker-postgres` container, HS256-sign the user JWT; ~10 lines, stdlib
  `hmac`/`hashlib`) and drop `reconciler.token` entirely. Fall back to the file
  only if the DB is unreachable.
- **Status:** OPEN
