From 36e10962f7ed0b8266a4465a47d4bea4a3a349ff Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 13:08:51 +0200 Subject: [PATCH] Record deployed queue boundary Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d --- ...governed-execution-responsibility-chain.md | 31 ++++++++++++------- ...NESS-WP-0003-governed-runtime-integrity.md | 9 ++++++ 2 files changed, 29 insertions(+), 11 deletions(-) diff --git a/docs/adr/ADR-002-governed-execution-responsibility-chain.md b/docs/adr/ADR-002-governed-execution-responsibility-chain.md index c3f0291..239f1b8 100644 --- a/docs/adr/ADR-002-governed-execution-responsibility-chain.md +++ b/docs/adr/ADR-002-governed-execution-responsibility-chain.md @@ -37,11 +37,16 @@ but it is not an accurate description of the current governed chain: normalization. It neither stores credentials nor chooses organizational policy. -The current Activity Core worker API does not yet authenticate an individual -worker identity. `ACTIVITY_CORE_WORKER_TOKEN` authenticates a shared caller -class, while `worker_id` is request-supplied and is not bound to that principal. -That is a current-state limitation, not a property this decision may silently -upgrade into an identity guarantee. +At the first proposed revision of this decision, the Activity Core worker API +authenticated a shared caller class while `worker_id` was request-supplied and +not principal-bound. Activity Core subsequently deployed `ACTIVITY-WP-0036` at +revisions `f0a897e` and `3cd5250`: `ACTIVITY_CORE_WORKER_TOKEN` is now bound to +configured `ACTIVITY_CORE_WORKER_ID=rein-aharness@railiance01`; mismatched body +identity and operator/SSO mutation credentials are rejected; and heartbeat, +completion, and failure row-lock and reject missing, equal-to-expiry, or expired +leases. The rollout has automated and live spoof-refusal evidence; a natural +late-heartbeat/close production observation remains pending because no claimed +row existed and no unrelated run was manufactured for the proof. Calling the rein the only enforcement point obscures these fail-closed boundaries. Calling it the only credential holder obscures custody and release @@ -61,7 +66,7 @@ The production target for unattended agentic repository mutation is: ```text Activity Core ops_run + lease - -> rein-aharness queue adapter (configured worker_id; principal binding target) + -> rein-aharness queue adapter (Activity-Core-bound configured worker_id) -> Glas pinned execution profile -> sand-boxer isolated venue -> selected rein and model/provider adapter @@ -102,7 +107,7 @@ recording evidence does not transfer that authority. | Concern | Authority / enforcement | Required evidence at the handoff | |---|---|---| | Schedule and task definition | Activity Core definition owner | definition id, trigger/idempotency key, target repo, bounded task, pinned profile, allowlisted organizational refs | -| Queue caller, identity, and lease | Current: Activity Core authenticates a shared worker caller class; `worker_id` is request-supplied, and rein-aharness claims, heartbeats, and closes with its configured value. Required target: Activity Core binds an approved credential/principal to that configured `worker_id`, rejects mismatches, and rejects heartbeat/completion/failure at or after lease expiry | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state | +| Queue caller, identity, and lease | Activity Core binds the approved worker token to configured `worker_id`, rejects body/principal mismatch and non-worker mutation credentials, and rejects heartbeat/completion/failure at or after lease expiry; rein-aharness claims, heartbeats, and closes with that configured identity | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state | | Governed actor identity | Channel/rein adapter maps this runtime to `agt`; Glas and sand-boxer validate the governed actor enum | actor plus request/run correlation; queue `worker_id` remains separate | | Organizational authority | Workforce/leadership owners upstream of Activity Core | allowlisted assignment, role, duty, goal, and resource-envelope refs; refs are attribution, not authorization | | Execution constellation | Glas profile catalog and resolver | exact profile/rein/model/tool/sandbox revisions, readiness state, resolution outcome | @@ -160,9 +165,10 @@ does not reopen profiled failures itself. runtime wiring remains unchanged. - T02 must make Activity Core lease loss observable inside execution and bind a repository lock/transaction to the claimed run. -- Before the strategic route is ready, Activity Core must publish and enforce a - worker-principal/`worker_id` binding contract plus fail-closed expired-lease - mutation semantics. A shared caller token is not sufficient identity proof. +- Activity Core deployed the required worker-principal/`worker_id` binding and + fail-closed expired-lease mutation semantics under `ACTIVITY-WP-0036`. + A natural late-heartbeat/close observation remains integration evidence for a + future real claimed row, not a reason to manufacture unrelated work. - T03 must make repository acceptance and required result delivery reconcilable. Best-effort Hub telemetry is not sufficient completion proof. - T04 may migrate, but may not expand, the profile-absent compatibility table. @@ -200,6 +206,9 @@ Reviews requiring follow-up: route and no-fallback posture confirmed, but acknowledgement withheld until the shared-caller/current-state limitation, principal-to-`worker_id` target, Activity-Core-side expired-lease rejection, and explicit break-glass boundary - were recorded. Those edits are incorporated in this revision. + were recorded. Message `900801f4-0641-4e87-90e6-0279b6c892a6` reports those + boundaries deployed at revisions `f0a897e` and `3cd5250`, with 468 tests, + live spoof-refusal evidence, and no manufactured late-close run. Those facts + are incorporated in this revision for final Activity Core acknowledgement. Pending: revised Activity Core acknowledgement, sand-boxer, and llm-connect. diff --git a/workplans/HARNESS-WP-0003-governed-runtime-integrity.md b/workplans/HARNESS-WP-0003-governed-runtime-integrity.md index ebc2123..ac96036 100644 --- a/workplans/HARNESS-WP-0003-governed-runtime-integrity.md +++ b/workplans/HARNESS-WP-0003-governed-runtime-integrity.md @@ -126,6 +126,15 @@ and T02–T06 can cite stable decisions rather than infer ownership from code. (`704aa396-52b7-4c9f-80b7-6cf8a81ce0a1`). Glas reconfirmed the exact revision and digest in `9638537b-e3c3-414d-a2d7-8beab61a4e1f`; revised Activity Core, sand-boxer, and llm-connect acknowledgements remain pending. +- Activity Core message `900801f4-0641-4e87-90e6-0279b6c892a6` reports the + requested boundary deployed under `ACTIVITY-WP-0036` at revisions `f0a897e` + and `3cd5250`: the worker token is bound to configured + `rein-aharness@railiance01`, mismatched body and operator/SSO identities are + rejected, and heartbeat/complete/fail enforce row-locked active leases with + equal-to-expiry treated as expired. Its 468-test suite and live spoof refusal + passed. ADR-002 now records this as deployed current state; natural + heartbeat/late-close production evidence remains pending for the next real + claimed row rather than a manufactured run. ## Make each repository run a lease-bound transaction