fix: keep workload confirmations server-side

scripts/ito.js

@@ -59,8 +59,8 @@ Important:
   - "evals" invokes only the canonical CLI's double-opt-in, pinned
     sixtytwo-cli node-qualification adapter against explicit nodes.
   - Node qualification cannot rent, launch, recover, repair, or purchase.
-  - Serve/train require an existing server-verified entitlement and a short-lived
-    portal-issued human confirmation in ITO_WORKLOAD_CONFIRMATION_TOKEN.
+  - Serve/train require an existing server-verified entitlement and matching
+    unconsumed same-origin confirmation state in the canonical backend.
   - Workload cancellation and cleanup never terminate the paid entitlement.
   - Inventory and RFQs are not reservations; only a returned firm quote is firm.
 
@@ -209,11 +209,6 @@ function parseArgs(argv, environment = process.env) {
     validateNodeQualificationArgs(withoutJson, environment);
   }
   if (command === "serve" || command === "train") {
-    if (!environment.ITO_WORKLOAD_CONFIRMATION_TOKEN?.trim()) {
-      throw new Error(
-        `${command} requires a portal-issued ITO_WORKLOAD_CONFIRMATION_TOKEN before any process is started.`
-      );
-    }
     validateTypedOptions(withoutJson, [
       "--entitlement", "--artifact-ref", "--image-digest",
       "--max-runtime-seconds", "--max-incremental-cost-usd", "--idempotency-key",

scripts/lib/ito-environment.js

@@ -78,10 +78,6 @@ function createSafeItoEnvironment(source = process.env, options = {}) {
     }
   }
 
-  if (options.includeWorkloadConfirmation) {
-    copyDefined(source, safe, "ITO_WORKLOAD_CONFIRMATION_TOKEN");
-  }
-
   if (options.includeControls) {
     for (const key of ECC_ITO_CONTROL_KEYS) {
       copyDefined(source, safe, key);
@@ -106,7 +102,6 @@ function createSafeItoInvocationEnvironment(
     includeItoRuntime: ITO_RUNTIME_COMMANDS.has(command),
     includeItoApiKey: ["auth", "find", "status", "serve", "train", "workload-status", "workload-cancel", "workload-cleanup"].includes(command),
     includeItoEvals: command === "evals",
-    includeWorkloadConfirmation: command === "serve" || command === "train",
   });
 }