Harden ops run identity and leases
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a028de-e2c8-7732-8521-46a7fc5db82f
This commit is contained in:
parent
36161d346f
commit
f0a897e088
13 changed files with 522 additions and 50 deletions
|
|
@ -22,6 +22,11 @@ issue-core and not a Forgejo ticket.
|
|||
| Complete | `POST /ops-runs/{id}/complete` | `{ worker_id, result }` |
|
||||
| Fail | `POST /ops-runs/{id}/fail` | `{ worker_id, error, reopen? }` |
|
||||
|
||||
The worker token is bound by Activity Core to one configured `worker_id`.
|
||||
Every worker mutation must name that exact identity and must still hold a lease
|
||||
whose deadline is strictly in the future. Operator/SSO authentication does not
|
||||
substitute for worker authentication on these calls.
|
||||
|
||||
Full field list, auth, and env: **`docs/ops-run-queue.md`**.
|
||||
Consumer implementation (rein-aharness): **REIN-A-0002**.
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue