coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden ops run identity and leases
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Build and Publish Container Image / build-and-push (push) Successful in 33s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
tegwick 2026-08-23 13:01:46 +02:00
parent 36161d346f
commit f0a897e088
13 changed files with 522 additions and 50 deletions
Download patch file Download diff file Expand all files Collapse all files

8
docs/runbook.md
View file

@ -456,7 +456,7 @@ curl -sS -X POST "http://localhost:8010/ops-runs/claim" \
# Reopen stale leases
curl -sS -X POST "http://localhost:8010/ops-runs/expire-leases" \
-H "X-Worker-Token: $ACTIVITY_CORE_WORKER_TOKEN"
-H "X-Operator-Token: $ACTIVITY_CORE_OPERATOR_TOKEN"
```
| Env | Default | Meaning |
@ -466,6 +466,12 @@ curl -sS -X POST "http://localhost:8010/ops-runs/expire-leases" \
| `OPS_RUN_MAX_ATTEMPTS` | `3` | Fail permanently after N claims |
| `OPS_RUN_SLA_HOURS` | `1` | Stuck threshold in status |
| `ACTIVITY_CORE_WORKER_TOKEN` | unset | Harness claim auth |
| `ACTIVITY_CORE_WORKER_ID` | unset | Exact worker identity bound to claim auth |
Worker mutations reject a body `worker_id` that differs from
`ACTIVITY_CORE_WORKER_ID`, and heartbeat/complete/fail reject a missing or
expired lease. Set the token and identity together before starting the claim
consumer.
Glas-backed workers may return the Glas 1.0 `GatewayResult` on complete or
fail. Activity Core persists only `result.execution_evidence` plus the existing