[tonythethompson]

Summary

A Debug Trackdub-gated build trusts a hardcoded dev ring (dev-2026-07, issuer trackdub://dev-activation, audience trackdub-license-dev). Nothing in this repo reproduced that issuer, so there was no way to run this Worker as the dev issuer for the desktop.

• npm run dev:activation:local: wrangler dev on 127.0.0.1:8787 with the production config's vars overridden on the command line (APP_ENV=development, dev issuer/audience/key ID, ALLOW_DEV_LICENSES=true). --local only, so no remote bindings.
• npm run db:seed:activation:dev-license: inserts the licenses row for the fixed dev key TDUB-DEV-UNLIMITED-LOCAL into the local D1. The lookup runs before the dev-key check, so the row is required.
• docs/ACTIVATION-CONTRACT.md: a "Local testing with a Debug desktop build" section.

The production and staging configs are untouched. ALLOW_DEV_LICENSES is still refused when APP_ENV=production, and a Release build's production ring degrades dev_unlimited tokens to Free.

Pairs with trackdubllc/Trackdub-gated#149, which replaces the Debug ring's public key (the old key's private half was in no repo).

Verification

• Ran the same wrangler dev command locally and activated TDUB-DEV-UNLIMITED-LOCAL: the token has kid/iss/aud matching the Debug ring and dev_unlimited: true, and verifies against the dev public key.
• The two npm scripts ran through npm in a clean worktree: migration plus seed produce one pro/active row in the local D1.
• Not run through npm: dev:activation:local itself (identical flags were run directly).

🤖 Generated with Claude Code

Summary by CodeRabbit

• Documentation
  • Added guidance for testing activation locally with Debug desktop builds, including setup steps and differences in development-key behavior between Debug and Release builds.
• Chores
  • Added commands for running the activation service locally and preparing its development database.
• Tests
  • Added a check that the local development license setup uses the expected key hash.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-22T04:40:30.848039Z	a228ae5	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

@tonythethompson doesn’t have a CodeRabbit review seat.

• Request a review seat for @tonythethompson

Open in CodeRabbit

Summarized by CodeRabbit Free

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: CHILL
• Plan: Free
• Run ID: 5754eb79-21c6-4815-afd2-408ee2717b07

📥 Commits

Reviewing files that changed from the base of the PR and between 12ba3b5 and 6afb15d.

📒 Files selected for processing: 3

• docs/ACTIVATION-CONTRACT.md
• package.json
• test/activation/dev-license.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📝 Walkthrough

The changes add instructions and package scripts for testing activation locally with a development license. A test checks that the seed script contains the SHA-256 hash of the fixed dev license key.

Changes: Local Activation Development

Layer / File(s)

Summary

Local activation setup and verification docs/ACTIVATION-CONTRACT.md, package.json, test/activation/dev-license.test.ts

The documentation describes local Worker and database setup, development credentials, and desktop activation. Package scripts run the Worker, seed a local Pro license, and run local migrations. The instructions state that the dev key bypasses the machine cap, Release builds treat its tokens as Free, and production refuses ALLOW_DEV_LICENSES. The test checks that the seed script contains the hash of DEV_UNLIMITED_LICENSE_KEY.

Estimated code review effort: 2 (Simple) | ~10 minutes

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[amazon-q-developer]

Review Summary

This PR adds developer tooling scripts and documentation to enable local end-to-end testing of the activation Worker against a Debug desktop build. The production and staging configs are untouched, which is the right approach.

One blocking concern was identified:

• package.json line 28 — max_machines: 1 vs. "skips the machine cap": The seed row sets the machine cap to 1, but the documentation claims the dev key bypasses the cap. Whether this is actually safe depends entirely on the execution order inside the activation handler — if ALLOW_DEV_LICENSES / dev_unlimited is checked after the seat-count guard, the cap is enforced rather than skipped, breaking the stated dev workflow on any second activation. This needs to be verified and either the seed value corrected or the ordering guaranteed and documented.

No changes were made to production secrets, remote databases, or the activation wire contract, so the surface area of risk is limited to the local dev flow.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.

[opencode-agent]

Automated review: 2 inline finding(s); the summary follows as a comment.

[opencode-agent]

Review submitted. Summary index:

---

Review: pullrequestreview-5609352798 — 2 inline findings on a low-risk docs+scripts PR. The dev-bypass guard (ALLOW_DEV_LICENSES refused when APP_ENV=production), the --local-only bindings, and the new docs' issuer/audience/key-id/port claims all check out against the code and config; the seed SQL is schema-compatible and idempotent.

Inline findings

• docs/ACTIVATION-CONTRACT.md:198 — important · docs-accuracy — .dev.vars example lists only SIGNING_KEY, but config.ts requires ADMIN_API_TOKEN (≥16 chars) to boot; the section gives no local-dev guidance for it. (One-line suggestion provided.)
• package.json:28 — suggestion · test-coverage — the seed's hardcoded key_hash literal is never checked by tests (dev-license tests compute the hash at runtime), so a drift would pass CI but silently break the documented activation flow. (No contiguous fix; described.)

Out of diff

• Desktop-side claim ("a Release build rejects its tokens because the production ring degrades dev_unlimited to Free") lives in the Trackdub-gated repo, not this one — unverifiable here, not contradicted by anything in this repo. Out of scope.

The seed's hardcoded key_hash value itself was not re-computed in this environment, but the PR author's verified activation of TDUB-DEV-UNLIMITED-LOCAL (a valid token returned) establishes the lookup matched, so the hash is treated as correct rather than raised as an open question.

github run

[opencode-agent]

No noteworthy issues found.

github run