[toothbrush]

https://entire.io/gh/entireio/forgemark/trails/5

Why

entire-core stops issuing jurisdiction tokens in https://github.com/entirehq/entiredb/pull/4313 (ADR 20260729). ForgeMark's Entire path still exchanged the subject token for one, so every Entire run would fail with invalid_target once that deploys.

What

• The subject token passed as -token-file/ACCESS_TOKEN is the account access token; entiredb authorizes each push live on it, so it is presented as-is. The RFC 8693 exchange, its refresh goroutine and the singleflight dependency are gone.
• -token-url, -jurisdiction and -client-id are still accepted: their presence selects the Entire path, so existing invocations (infra bootstrap, compare-local.sh, the GUI suggest endpoint) keep working. None of them is dialed.

Note: the run is now bounded by the subject token's own lifetime (45m for a federated service-account session, 8h for a login). A sweep whose remaining levels outlast the token's exp is refused after discovery and again before each measured window. Gate findings added replica pinning (scheme, parent domain, port, bare origin, case-folded). Discovery follows Entire's ALB 307 one hop, only to a pinned replica, with its own credential; pushes and cleanup refuse redirects.

Verification

go build ./..., go vet ./..., go test ./... pass.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes authentication for Entire benchmarks (credential shape and lifetime); behavior is simpler but long runs are bounded by the access token TTL instead of exchanged jurisdiction tokens.

Overview
Aligns ForgeMark’s Entire target with ADR 20260729 (entiredb no longer issues jurisdiction tokens): -token-file / ACCESS_TOKEN is now sent as HTTP basic-auth as the account access token, with live authorization on each push, instead of exchanging it via RFC 8693.

The jurisdictionCreds implementation is removed—no OAuth POST to -token-url, no refresh goroutine, no singleflight—and setupEntiredb wires staticCreds like other forges. -token-url, -jurisdiction, and -client-id still select the Entire path for backward compatibility (scripts, GUI suggest); docs and flag help note they are not dialed. golang.org/x/sync drops from direct go.mod requires.

README and server audience-validation comments are updated to match the new model; long Entire credential tests are replaced with a staticCreds unit test.

^{Reviewed by Cursor Bugbot for commit 109aeee. Configure here.}

[toothbrush]

Live smoke test at e50e1ce

Against the au cluster after entiredb 18b8a5ee2e (jurisdiction token removed) was deployed. Remote is the cluster URL, so discovery took the ALB 307 hop to a pinned replica (3 nodes reported). Repo et/paul/forgemark-target, 10s windows, 2s warmup.

forgemark -remote https://aws-ap-southeast-2.entire.io \
  -token-url https://au.auth.entire.io/oauth/token -jurisdiction https://au.entire.io \
  -token-file - -repos et/paul/forgemark-target -concurrency 1,2 -duration 10s -warmup 2s

strategy	c	ok	ops/s	p50 ms	p95 ms	errors
push	1	65	6.5	149	158	0
push	2	127	12.7	150	200	0
clone	1	49	4.9	200	201	0
clone	2	96	9.6	205	210	0

• Direct-to-node run (-remote https://cobar.aws-ap-southeast-2.entire.io) gave the same numbers, so the redirect hop costs nothing measurable.
• stderr and stdout of every run scanned for the raw token: absent. Relevant because the ALB 307 embeds the caller's credential in Location (server-side, tracked in COR-1992, present since May 2026, not a regression).
• go test ./... green on this tip.