| 1 | -- A self-hosted runner's harness spends the job's token on fetching the |
| 2 | -- job, and gets a new one in its place (plan.rs `job_spec` with `rotate`). |
| 3 | -- The token the job started with stops working for everything but |
| 4 | -- `brokered_secrets`, which the runner Worker asks with the token it was |
| 5 | -- given at the start and which no API route passes on: its hash is kept |
| 6 | -- here from the swap until the job ends or is claimed again. |
| 7 | ALTER TABLE jobs ADD COLUMN first_token_hash TEXT; |