feat(infra): add Tarmac to the mill.render audience allowlist

[JustAGhosT]

Summary

• Adds neuralliquid-tarmac-mill-s2s to mystira_oidc_render_audiences in infra/env/prod/terraform.tfvars, alongside the existing nexamesh-coiltrace-web entry.
• This is the Mill-side half of onboarding Tarmac's (neuralliquid/tarmac) new OpenIddict client-credentials S2S client for document-render calls — companion PR: phoenixvc/mystira-workspace#4063 (draft, adds the neuralliquid-tarmac-mill-s2s confidential client).
• No dedicated resource audience was minted on the Mystira Identity side for this client (see companion PR) — Mill's audience check already accepts a delegated client's own client id as the token aud claim, matching the existing CoilTrace precedent (nexamesh-coiltrace-web is listed here by its own client id too). backend/auth.py's get_render_user comma-splits this env var, so no app-code change is needed.

Test plan

• terraform fmt -check -diff passes on the edited terraform.tfvars.
• Not applied — this PR stays draft. It only takes effect once the module reads the updated tfvars via a Terraform apply, and is only useful once Tarmac's OIDC client actually exists (companion PR) and Tarmac's own token fetch (packages/launchpad/src/mill.ts) is deployed.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: ee099a02-3aa9-4575-bfe7-d6667561ba7f

📥 Commits

Reviewing files that changed from the base of the PR and between 42f2320 and 263d985.

📒 Files selected for processing (1)

• infra/env/prod/terraform.tfvars

Included review availability: Your plan provides up to 10 included reviews per hour; 3 remain after this review.

📜 Recent review details

⏰ Context from checks skipped due to timeout. (1)

• GitHub Check: Kilo Code Review

🔇 Additional comments (1)

infra/env/prod/terraform.tfvars (1)

60-60: LGTM!

---

📝 Walkthrough

Summary by CodeRabbit

• Configuration
  • Updated production authentication settings to accept an additional trusted audience.

Walkthrough

The production Terraform configuration now accepts neuralliquid-tarmac-mill-s2s in addition to nexamesh-coiltrace-web for mystira_oidc_render_audiences.

Changes

OIDC audience configuration

Layer / File(s)	Summary
Production audience update infra/env/prod/terraform.tfvars	The production OIDC audience list includes neuralliquid-tarmac-mill-s2s alongside nexamesh-coiltrace-web.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Merge Risk: ⚪ Minimal · up to 263d9

This adds Tarmac’s client ID to the production render-audience allowlist without changing application code; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description accurately explains the Terraform allowlist change, its purpose, dependencies, and test status.
Title check	✅ Passed	The title clearly identifies the infrastructure change and the addition of Tarmac to the Mill render audience allowlist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0 files. (1 skipped: 1 unsupported.)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/tarmac-mill-render-audience

---

_{Comment @coderabbitai help to get the list of available commands.}

[greptile-apps]

JustAGhosT has reached the 50-credit limit for trial accounts. To continue receiving code reviews, upgrade your plan.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Files Reviewed (1 file)

• infra/env/prod/terraform.tfvars - 1 line changed

---

_{Reviewed by free · Input: 56.6K · Output: 5.8K · Cached: 234.8K}