coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(deploy): gate claims on pinned runtime readiness

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
tegwick 2026-09-04 20:08:37 +02:00
parent d00ffcb402
commit 4310c15eac
17 changed files with 757 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

12
deploy/scripts/install-claim-loop-user.sh
View file

@ -9,6 +9,9 @@ ENV_DIR="${HOME}/.config/rein-aharness"
BIN_DIR="${HOME}/bin"
mkdir -p "${UNIT_DIR}" "${ENV_DIR}" "${BIN_DIR}"
# Refuse to install a service unit over accidental mutable sibling revisions.
python3 "${ROOT}/scripts/verify_runtime_lock.py"
cp -f "${ROOT}/deploy/systemd/rein-aharness-claim-loop.service" "${UNIT_DIR}/"
# Durable env loader + k8s:// ClusterIP resolution (no port-forward)
install -m 755 "${ROOT}/deploy/scripts/rein-aharness-claim" "${BIN_DIR}/rein-aharness-claim"
@ -24,10 +27,13 @@ fi
# Ensure package entrypoint exists
if [[ ! -x "${ROOT}/.venv/bin/rein-aharness" ]]; then
echo "warning: ${ROOT}/.venv/bin/rein-aharness missing; install the worker environment first"
echo "error: ${ROOT}/.venv/bin/rein-aharness missing" >&2
echo "run ${ROOT}/deploy/scripts/install-pinned-runtime.sh first" >&2
exit 2
elif ! "${ROOT}/.venv/bin/python" -c 'import glas_harness, sandboxer' >/dev/null 2>&1; then
echo "warning: profiled ops runs require sibling runtimes; install with:"
echo " ${ROOT}/.venv/bin/pip install -e ${ROOT}/../sand-boxer -e ${ROOT}/../glas-harness"
echo "error: pinned profiled runtime packages are unavailable" >&2
echo "run ${ROOT}/deploy/scripts/install-pinned-runtime.sh first" >&2
exit 2
fi
systemctl --user daemon-reload

18
deploy/scripts/install-pinned-runtime.sh Executable file
View file

@ -0,0 +1,18 @@
#!/usr/bin/env bash
# Reproduce the host worker from uv.lock plus exact, clean sibling revisions.
set -euo pipefail
REPO_ROOT="$(cd "$(dirname "$0")/../.." && pwd)"
cd "${REPO_ROOT}"
command -v uv >/dev/null 2>&1 || {
echo "install-pinned-runtime: uv is required" >&2
exit 2
}
python3 scripts/verify_runtime_lock.py
uv sync --frozen --no-editable --extra glas --extra llm
.venv/bin/python -c 'import glas_harness, llm_connect, rein_aharness, sandboxer'
.venv/bin/rein-aharness preflight --offline
echo "Pinned non-editable runtime installed from uv.lock and runtime-contract-lock.json"