coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden ops run identity and leases
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
tegwick 2026-08-23 13:01:46 +02:00
parent 36161d346f
commit f0a897e088
13 changed files with 522 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

13
docs/deploy-ops-run-queue-railiance.md
View file

@ -90,8 +90,9 @@ explicit is better for ops):
| `OPS_RUN_LEASE_SECONDS` | `900` | Optional |
| `OPS_RUN_MAX_ATTEMPTS` | `3` | Optional |
| `OPS_RUN_SLA_HOURS` | `1` | Status stuck threshold |
| `ACTIVITY_CORE_WORKER_ID` | `rein-aharness@railiance01` | Exact non-secret identity bound to the worker token |
Optional worker auth (recommended before external claim):
Worker auth (required before external claim):
```bash
# Generate once; store in secret — do not commit
@ -101,6 +102,10 @@ kubectl -n activity-core patch secret actcore-runtime-secret --type merge \
# Record token in operator secret store (OpenBao / password manager), not chat.
```
Apply the ConfigMap identity and Secret token in the same rollout. If the token
is present without `ACTIVITY_CORE_WORKER_ID`, worker mutations fail with 503;
if a request body names another identity, they fail with 403.
Apply:
```bash
@ -223,11 +228,11 @@ curl -sS "http://127.0.0.1:8010/ops/automations/status?since=today" \
### 6. Claim path smoke (manual, no harness yet)
```bash
WORKER_TOKEN=… # from secret if set; else local-dev open auth
WORKER_TOKEN=… # from secret
curl -sS -X POST "http://127.0.0.1:8010/ops-runs/claim" \
-H "Content-Type: application/json" \
-H "X-Worker-Token: ${WORKER_TOKEN}" \
-d '{"worker_id":"smoke@railiance01","labels":["automated"],"limit":1,"lease_seconds":120}' \
-d '{"worker_id":"rein-aharness@railiance01","labels":["automated"],"limit":1,"lease_seconds":120}' \
| python3 -m json.tool
```
@ -239,7 +244,7 @@ RUN_ID=… # from claim response
curl -sS -X POST "http://127.0.0.1:8010/ops-runs/${RUN_ID}/fail" \
-H "Content-Type: application/json" \
-H "X-Worker-Token: ${WORKER_TOKEN}" \
-d '{"worker_id":"smoke@railiance01","error":"T07 smoke only","reopen":true}'
-d '{"worker_id":"rein-aharness@railiance01","error":"T07 smoke only","reopen":true}'
```
- [ ] Claim returns the open run