coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(deploy): gate claims on pinned runtime readiness

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a06ba0-10aa-7ea0-b20a-4f3fac39efe9
This commit is contained in:
tegwick 2026-09-04 20:08:37 +02:00
parent d00ffcb402
commit 4310c15eac
17 changed files with 757 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

36
docs/ops-run-claim-loop.md
View file

@ -90,6 +90,9 @@ rein-aharness poll --source=ops-run
rein-aharness claim-loop
rein-aharness claim-loop --once --verbose
# Read-only startup readiness (never claims)
rein-aharness preflight
# Required close evidence and recovery
rein-aharness close-outbox status
rein-aharness close-outbox replay
@ -109,8 +112,7 @@ rein-aharness run --from-issue-core
```bash
# From rein-aharness checkout on railiance01
python3 -m venv .venv
.venv/bin/pip install -e . -e ../llm-connect -e ../sand-boxer -e ../glas-harness
./deploy/scripts/install-pinned-runtime.sh
./deploy/scripts/install-claim-loop-user.sh
# Or manually:
@ -122,6 +124,36 @@ systemctl --user enable --now rein-aharness-claim-loop.service
journalctl --user -u rein-aharness-claim-loop -f
```
The unit runs `rein-aharness preflight` through the same environment-loading
wrapper before every start. It probes Activity Core with a read-only open-run
list, verifies configured repository workspaces and private runtime state, and
refuses unresolved close-evidence quarantine without claiming or executing
work. Pending close evidence is allowed through startup because the first
claim-loop cycle replays it before any new claim; quarantine requires operator
review.
Set `AGENT_HARNESS_REQUIRED_PROFILE_REFS` to the comma-separated exact
`profile@version` references enabled for production. Every named profile must
resolve through the installed Glas catalog with `operational_readiness: ready`.
A ready `profile.bwrap-local` also executes a minimal bwrap namespace probe,
which detects missing bubblewrap and host user-namespace/AppArmor refusal.
Leaving the variable empty declares that no profiled production definition is
enabled; this does not make a blocked profile executable or introduce fallback.
Use `rein-aharness preflight --offline` only while installing or diagnosing
local files. It skips the Activity Core probe and is not the systemd gate.
`install-pinned-runtime.sh` first verifies clean sibling checkouts against
`deploy/runtime-contract-lock.json`, then applies the checked-in `uv.lock` with
`--frozen --no-editable`. This prevents the authoritative service from running
against whichever mutable editable sibling happened to be present. Updating a
runtime contract requires reviewing and committing both locks together.
`make contract-test` is the non-skippable cross-package release gate. It imports
Glas, sand-boxer, and llm-connect before running the contract/claim suites, so
the optional `pytest.importorskip` development behavior cannot turn a missing
production dependency into a green release result.
### Host access to cluster services (no port-forward)
On railiance01 (single-node k3s), set **k8s://** pseudo-URLs in