$ the-wire · showcase
Gateway stops trusting stale signing keys, tokio publishes to internal registry
By RepoJournal · Filed · About Anthropic · Composed from the cited sources · methodology
A WIF gateway sample now bounds how long it will accept withdrawn signing keys during an issuer outage, and tokio's publish job moves off cargo publish onto an internal registry upload client.
Limit how long cached signing keys are trusted when refreshes fail anthropics/claude-tag-wif-gateway-sample
Until now the 300 second cache lifetime only decided when to refresh, and a failed or empty refresh never dropped keys, so a key the issuer had withdrawn stayed accepted for the entire outage. The fix adds one limit, MAX_KEY_AGE_SECONDS in gateway/constants.py, shipped at one hour and measured from the last successful fetch on the monotonic clock the cache already uses.
Publish tokio through the internal registry's upload client (#25) anthropics/tokio
The job used to run cargo publish; it now pushes tokio through the internal registry's upload client, a squash merge of one commit. The workflow embeds internal names for the registry, the upload tool and its download address, the token audience, the upload collection, and the tool's version and sha256.
Add GovTribe plugin (govtribe) anthropics/claude-plugins-official
GovTribe's govtribe plugin lands from GovTribe/claude-plugin, pinned to d3e0c82c6c4f960320c010ceb8aabb463f1fb7d2 at release v1.0.1, with .claude-plugin/plugin.json plus skills and an .mcp.json pointing at https://govtribe.com/mcp. Apache-2.0, and no hooks, agents, commands or scripts.
Add Vanguard Advisor Tools plugin (vanguard-advisor-tools) anthropics/claude-plugins-official
Vanguard's vanguard-advisor-tools plugin is pinned to 328fe9f61fe7a375b87a6492e265b4a5a955b0ce at v1.3.0, confirmed by the partner, and declares a single HTTP MCP server at https://mcp.vanguard.com/advisors. Like the GovTribe plugin it ships only plugin.json and skills, with no hooks, agents, commands or scripts.
Action items
- → Review whether your gateway deployment relies on cached signing keys surviving issuer outages; MAX_KEY_AGE_SECONDS no... anthropics/claude-tag-wif-gateway-sample [plan]
- → Answer the tokio publish question for the anthropic-1.49.0 branch if it still releases, so the same registry upload c... anthropics/tokio [plan]
