coulomb/rein-aharness
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Define repository grant contract

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d
This commit is contained in:
tegwick 2026-08-23 13:23:50 +02:00
parent ce8f56afea
commit 8cb004a558
8 changed files with 581 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

27
workplans/HARNESS-WP-0003-governed-runtime-integrity.md
View file

@ -244,10 +244,29 @@ unchanged `HEAD`, remote-ref movement, Git config/hook changes, and bounded path
evidence. The full suite passes 123 tests with the existing optional
`glas_harness` contract skip.
No current `TaskSpec` or instance-manifest field supplies an authoritative path
grant, so the validator remains deliberately unwired. Defining that versioned
grant surface, metrics atomicity, and required close-evidence reconciliation
remain outstanding; T03 remains `wait`.
No current Activity Core/profile field supplies an authoritative path grant, so
the validator remains deliberately unwired. Metrics atomicity and required
close-evidence reconciliation also remain outstanding; T03 remains `wait`.
### Repository grant preparation — 2026-08-23
Added a parsed, versioned `repository_grant` v1 contract for `TaskSpec` inputs.
It requires explicit repository-relative path patterns, bounded positive commit
counts, `publish: false`, exact fields, and version `"1"`; it rejects unknown
fields, ambiguous types, duplicates, traversal/`.git` paths, and publication.
The canonical grant exposes a stable id and bounded path/policy digests and
translates directly to `RepositoryAcceptancePolicy`.
This is fail-closed preparation, not production enablement. A supplied grant
causes `run_task` to refuse before profile resolution or adapter dispatch, and
the Activity Core/issue-core adapters do not synthesize it from labels, prose,
`execution_refs`, or repo lookup. Existing grant-absent compatibility behavior
is unchanged. `docs/repository-grant.md` records the contract and the remaining
activation gates: authoritative upstream carriage, lease-bound transaction
wiring, accepted-result validation, and durable close evidence.
Thirty-three focused cases cover canonical identity/evidence, validator translation,
schema/type/path/commit/publication refusal, typed task-file parsing, and proof
that the runner neither dispatches an adapter nor mutates the checkout.
## Remove tenant logic from the shared runtime