[bajtos]

The first run of E2E tests (fil-forge/infra-nodes#154) discovered that Hilt in dev cannot delete tenants because it was configured to use the production revocation service. I decided to make the revocation service config required to avoid similar surprises in the future.

---

Written by Claude.

Do not merge until fil-forge/infra-central#264, which sets HILT_REVOCATION_SERVICE_ID and HILT_REVOCATION_SERVICE_URL per stage, is applied to dev, staging and prod. After this lands, a Hilt task without them exits at startup.

Require revocation.service_id and revocation.service_url instead of defaulting them to prod's Swarf (did:web:revoke.fil-forge.com / https://revoke.fil-forge.com).

Dev's ECS task sets neither variable, so dev Hilt published revocations to prod's Swarf. Prod Swarf does not know dev tenants' did:plc DIDs and answers 404, which turned every dev tenant delete into a 500. Staging has the same gap.

• Remove both SetDefault calls in pkg/config and the --revocation-service-* flag defaults in cmd/main.go.
• NewRevocationClient rejects an empty DID or URL, so hilt serve exits during fx construction with revocation.service_id is required: set HILT_REVOCATION_SERVICE_ID or --revocation-service-id (or the _url equivalent). The check is explicit because url.Parse("") succeeds and would otherwise build a client that fails only on its first publish.
• The hilt client commands load config but never build the revocation client, so they keep working without these settings.
• Tests: config.Load leaves both fields empty when nothing sets them; NewRevocationClient errors on each missing field; an fx app with RevocationModule and empty config fails to construct.
• README and AGENTS.md mark both settings required.

The integration stack keeps booting: smelt's systems/hilt/compose.yml already sets HILT_REVOCATION_SERVICE_ID=did:web:swarf and HILT_REVOCATION_SERVICE_URL=http://swarf:80.

upload.service_id, upload.service_url and upload.product_id still default to prod values in the same way. They are left for a separate change.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-16T15:53:43.676295Z	210243e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

The change makes Hilt crash at startup across all stages when the settings are unset and is explicitly gated on an external infra PR being applied first, which requires human deployment coordination.

0 open findings

What changed in this PR

This PR makes the Swarf revocation service settings (revocation.service_id and revocation.service_url) required rather than defaulting them to prod's Swarf. Previously, dev and staging Hilt deployments—which don't set these variables—silently published revocations to prod's Swarf, which doesn't know their tenants' DIDs, turning every tenant delete into a 500. Now hilt serve fails fast at startup when either setting is missing, with a clear actionable error, while hilt client commands (which never build the revocation client) keep working.

Changes:

• Remove the SetDefault calls in pkg/config and the flag defaults in cmd/main.go, replacing them with explicit empty values and "required" documentation.
• Add explicit empty-value checks in fx.NewRevocationClient (needed because url.Parse("") succeeds and would otherwise defer the failure to first publish), plus tests for missing fields, module construction failure, and no-default loading.
• Update README.md and AGENTS.md to mark both settings as required.

File	Description
pkg/​fx/​revocation.go	Adds empty-string guards for ServiceID/ServiceURL with actionable error messages before parsing.
pkg/​config/​config.go	Removes the two SetDefault calls and documents why revocation settings have no default.
cmd/​main.go	Clears the --revocation-service-* flag defaults and marks them "(required)".
pkg/​fx/​revocation_test.go	Adds table-driven tests for missing fields and an fx-construction failure test.
pkg/​config/​config_test.go	Verifies the revocation config stays empty with no defaults.
README.md	Documents both settings as required and the startup-exit behavior.
AGENTS.md	Updates the local-run command to include the now-required flags.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.