test: cover worker identity migration lint

Author: arpankernel

CHANGELOG.md

@@ -31,6 +31,7 @@ This checkpoint starts hardening remote worker identity for public and enterpris
 - TLS client support for control-plane calls to remote worker RPC.
 - Worker RPC mTLS conformance test with generated CA, server, and client certificates.
 - Config lint checks for worker RPC TLS certificate and CA settings.
+- Cluster conformance coverage for signed-token migration lint warnings.
 - Phase 14 release notes under `docs/releases/phase-14-worker-identity-hardening.md`.
 
 ### Changed

docs/cluster-conformance.md

@@ -25,6 +25,7 @@ It currently verifies:
 - Worker RPC mTLS completes a real client-authenticated request using generated certificates.
 - Worker lease renewal is guarded by `worker:lease`.
 - A production-aligned cluster config with `auth.worker_tokens` or `auth.worker_signing_key` passes `stacyvm config lint --production`.
+- Signed-token migration lint warns when shared worker tokens or invalid signing-key rotation state remain configured.
 - Postgres configuration with a valid DSN passes `stacyvm config lint --production`.
 - Live Postgres passes the reusable store contract when `STACYVM_POSTGRES_TEST_DSN` is set.
 - Live Postgres proves one active lease holder under concurrent acquire and expired takeover attempts.

docs/releases/phase-14-worker-identity-hardening.md

@@ -78,6 +78,7 @@ Phase 14 begins the worker identity hardening lane for production multi-worker S
 - Updated the API docs for worker heartbeat and lease-renewal headers.
 - Updated the cluster conformance matrix to mark signed worker tokens as the public/enterprise worker identity path.
 - Updated production readiness notes to reflect signed worker tokens and the remaining issuer/rotation and mTLS work.
+- Added cluster conformance coverage for signed-token migration lint warnings.
 
 ## Code Areas Changed
 

scripts/ci-cluster-conformance.sh

@@ -116,6 +116,35 @@ sed \
   "$cluster_config" >"$signed_worker_config"
 go run ./cmd/stacyvm config lint --production --file "$signed_worker_config"
 
+echo "==> Linting signed-token worker identity migration warnings"
+mixed_worker_config="$tmpdir/stacyvm.signed-worker-mixed.yaml"
+sed \
+  -e '/worker_tokens:/,/admin_fallback_enabled:/c\
+  worker_token: "shared-worker-token-with-at-least-32-bytes"\
+  worker_signing_key: "worker-signing-key-with-at-least-32-bytes"\
+  admin_fallback_enabled: false' \
+  "$cluster_config" >"$mixed_worker_config"
+mixed_lint_output="$(go run ./cmd/stacyvm config lint --production --file "$mixed_worker_config")"
+if [[ "$mixed_lint_output" != *"shared worker token still configured with signed worker tokens"* ]]; then
+  echo "$mixed_lint_output"
+  echo "expected signed-token migration warning for shared worker token" >&2
+  exit 1
+fi
+
+invalid_rotation_config="$tmpdir/stacyvm.invalid-rotation.yaml"
+sed \
+  -e '/worker_tokens:/,/admin_fallback_enabled:/c\
+  worker_signing_key: "worker-signing-key-with-at-least-32-bytes"\
+  worker_signing_keys: ["worker-signing-key-with-at-least-32-bytes"]\
+  admin_fallback_enabled: false' \
+  "$cluster_config" >"$invalid_rotation_config"
+rotation_lint_output="$(go run ./cmd/stacyvm config lint --production --file "$invalid_rotation_config")"
+if [[ "$rotation_lint_output" != *"rotation keys include the active worker signing key"* ]]; then
+  echo "$rotation_lint_output"
+  echo "expected signed-token migration warning for invalid rotation keys" >&2
+  exit 1
+fi
+
 echo "==> Linting production-aligned Postgres cluster config"
 postgres_config="$tmpdir/stacyvm.postgres.yaml"
 sed \