coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0056-T13 (part): executor CLI, clients, Containerfile, image workflow
All checks were successful
Build and Publish bounded-executor / build-and-push (push) Successful in 23s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details
Identity provider journey acceptance / provider (push) Successful in 32s
Details

Browse source 
CLI entry point and approval-engine/audit-core clients; events carry
occurred_at (audit-core envelope); hash-locked image with pinned lldap
stage builds locally; image workflow and executor tests in CI; pilot
example pins the executed files. rapp reshaping still open.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
tegwick 2026-10-31 16:51:07 +01:00
parent fe18096aa3
commit ba9d266b7e
18 changed files with 694 additions and 33 deletions
Download patch file Download diff file Expand all files Collapse all files

11
bounded-executor/executor.py
View file

@ -295,14 +295,16 @@ class Run:
return "completed"
# ------------------------------------------------------------------ evidence
def _event(self, kind: str, body: dict) -> dict:
def _event(self, kind: str, body: dict, occurred_at: dt.datetime) -> dict:
"""audit-core's ingest envelope (docs/event-envelope.md): all eight fields, offset-qualified time."""
return {"id": f"run:{self.run_id}:{'started' if kind == STARTED else 'receipt'}", "type": kind,
"correlation_id": self.run_id, "subject": f"admission:{self.spec['id']}",
"source": "net-kingdom.bounded-executor", "tenant": self.cfg.tenant, "data": body}
"source": "net-kingdom.bounded-executor", "tenant": self.cfg.tenant,
"occurred_at": occurred_at.astimezone(dt.UTC).isoformat(timespec="seconds"), "data": body}
def _receipt(self, outcome: str, attempts: int) -> dict:
end = self.d.wall()
return self._event(RECEIPT, {
return self._event(RECEIPT, occurred_at=end, body={
"run_id": self.run_id,
"initiator": {"sub": self.approver_subject, "role": "approver"},
"executing_workload": self.cfg.executor_identity,
@ -343,7 +345,8 @@ class Run:
try:
self.d.audit.emit(self._event(STARTED, {"run_id": self.run_id, "admission": self.spec["id"],
"approval": self.approval_id, "consumed_at": self.consumed_at,
"executing_workload": self.cfg.executor_identity}))
"executing_workload": self.cfg.executor_identity},
occurred_at=self.d.wall()))
except Exception:
self.d.alert("started_not_in_custody", {"admission": self.spec["id"], "run_id": self.run_id})
return {"outcome": "stopped", "reason": "audit_unavailable", "run_id": self.run_id, "effects": "consume-only"}