From c230f336980a9202f4d8488e81b99e8b7fb2e927 Mon Sep 17 00:00:00 2001 From: tegwick Date: Sun, 23 Aug 2026 13:01:37 +0200 Subject: [PATCH] Clarify Activity Core queue boundary Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02b6f-7db1-7222-918b-e813a6bda38d --- ...governed-execution-responsibility-chain.md | 32 ++++++++++++++++--- ...NESS-WP-0003-governed-runtime-integrity.md | 7 ++++ 2 files changed, 34 insertions(+), 5 deletions(-) diff --git a/docs/adr/ADR-002-governed-execution-responsibility-chain.md b/docs/adr/ADR-002-governed-execution-responsibility-chain.md index 428a3ac..7c03e32 100644 --- a/docs/adr/ADR-002-governed-execution-responsibility-chain.md +++ b/docs/adr/ADR-002-governed-execution-responsibility-chain.md @@ -37,6 +37,12 @@ but it is not an accurate description of the current governed chain: normalization. It neither stores credentials nor chooses organizational policy. +The current Activity Core worker API does not yet authenticate an individual +worker identity. `ACTIVITY_CORE_WORKER_TOKEN` authenticates a shared caller +class, while `worker_id` is request-supplied and is not bound to that principal. +That is a current-state limitation, not a property this decision may silently +upgrade into an identity guarantee. + Calling the rein the only enforcement point obscures these fail-closed boundaries. Calling it the only credential holder obscures custody and release authority. Conversely, moving provider or tenant credentials into Glas would @@ -55,7 +61,7 @@ The production target for unattended agentic repository mutation is: ```text Activity Core ops_run + lease - -> rein-aharness queue adapter (worker identity -> actor agt) + -> rein-aharness queue adapter (configured worker_id; principal binding target) -> Glas pinned execution profile -> sand-boxer isolated venue -> selected rein and model/provider adapter @@ -96,7 +102,7 @@ recording evidence does not transfer that authority. | Concern | Authority / enforcement | Required evidence at the handoff | |---|---|---| | Schedule and task definition | Activity Core definition owner | definition id, trigger/idempotency key, target repo, bounded task, pinned profile, allowlisted organizational refs | -| Queue identity and lease | Activity Core authenticates the worker; rein-aharness claims, heartbeats, and closes as its configured `worker_id` | ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state | +| Queue caller, identity, and lease | Current: Activity Core authenticates a shared worker caller class; `worker_id` is request-supplied, and rein-aharness claims, heartbeats, and closes with its configured value. Required target: Activity Core binds an approved credential/principal to that configured `worker_id`, rejects mismatches, and rejects heartbeat/completion/failure at or after lease expiry | caller/principal class, binding contract/version, configured and accepted worker id, ops_run id, claim owner, attempt, lease/heartbeat outcome, final queue state | | Governed actor identity | Channel/rein adapter maps this runtime to `agt`; Glas and sand-boxer validate the governed actor enum | actor plus request/run correlation; queue `worker_id` remains separate | | Organizational authority | Workforce/leadership owners upstream of Activity Core | allowlisted assignment, role, duty, goal, and resource-envelope refs; refs are attribution, not authorization | | Execution constellation | Glas profile catalog and resolver | exact profile/rein/model/tool/sandbox revisions, readiness state, resolution outcome | @@ -108,7 +114,7 @@ recording evidence does not transfer that authority. | Repository grant | Consuming repo manifest/blueprint and the emitted task/profile define the allowed repository and paths | canonical repo identity, baseline, declared path/publish grant | | Repository transaction and acceptance | rein-aharness | transaction id, lease status, baseline and accepted commits, changed paths, clean post-state, remote-ref outcome | | Sandbox execution evidence | Glas normalizes rein and sand-boxer lifecycle facts | compact `ExecutionEvidence`, including outcome/failure stage and teardown; no prompts/tool/provider bodies | -| Queue result | Activity Core allowlists and stores the completion/failure envelope | terminal/reopened state and normalized execution evidence | +| Queue result | Activity Core allowlists and stores the completion/failure envelope; it must independently enforce active ownership and an unexpired lease on heartbeat, completion, and failure mutations | terminal/reopened state, mutation acceptance/refusal reason, lease state at mutation, and normalized execution evidence | | Work history and decisions | State Hub projects progress/decision records; repository workplan files remain work authority | correlation refs and value-safe progress/decision ids | | Instance learning/metrics | Consuming repo and kaizen-agentic own the schema; T03 will choose an atomic commit or durable external projection | run/transaction correlation and reconciled projection state | @@ -123,6 +129,11 @@ the repository-transaction and rein-local tool-policy enforcement point within a chained grant; it must not weaken or duplicate the authorities at queue, profile, credential, sandbox, and provider boundaries.** +Operator or SSO authentication is not worker mutation identity. It may cross +that boundary only through an explicit, separately authorized and audited +break-glass contract that records the operator principal, reason, scope, and +expiry; ordinary worker calls must not inherit operator authority. + ### 4. Failure classification | Failure | Current required disposition | Why | @@ -132,7 +143,7 @@ profile, credential, sandbox, and provider boundaries.** | Invalid actor or incomplete/ambiguous reachability | Terminal refusal/failure; no host-checkout fallback | Actor and execution venue are governed inputs | | Sandbox create, session start/execution/end, credential acquisition, or teardown failure | Terminal profiled attempt with normalized stage evidence; no legacy fallback | Re-running may duplicate effects; a new run may be emitted after repair or explicit policy | | Claim/list transport error before ownership | Retry after the configured full polling interval | No repository work has begun | -| Heartbeat rejection or confirmed lease loss | Stop dispatch, refuse repository acceptance, clean up, and leave reconciliation evidence | Work must not be accepted after ownership expires; T02 implements this | +| Heartbeat rejection or confirmed lease loss | Activity Core rejects heartbeat/completion/failure at or after lease expiry; rein-aharness stops dispatch, refuses repository acceptance, cleans up, and leaves reconciliation evidence | Both queue-side mutation rejection and executor-side cancellation are required; neither boundary can substitute for the other | | Legacy executor failure | Reopen only when the typed executor explicitly marks it retryable and Activity Core attempts remain; unmatched routes are terminal | Preserves current bounded coexistence without making all errors retryable | | Required close/evidence API outage after repository mutation | Reconcile the same transaction; do not rerun or create another workload commit | Completion delivery is uncertain, not the workload outcome; T03 implements the outbox/reconciler | | Optional State Hub telemetry outage | Continue only when the event is explicitly labelled best-effort and required evidence remains durable elsewhere | Observability must not masquerade as acceptance authority | @@ -149,6 +160,9 @@ does not reopen profiled failures itself. runtime wiring remains unchanged. - T02 must make Activity Core lease loss observable inside execution and bind a repository lock/transaction to the claimed run. +- Before the strategic route is ready, Activity Core must publish and enforce a + worker-principal/`worker_id` binding contract plus fail-closed expired-lease + mutation semantics. A shared caller token is not sufficient identity proof. - T03 must make repository acceptance and required result delivery reconcilable. Best-effort Hub telemetry is not sufficient completion proof. - T04 may migrate, but may not expand, the profile-absent compatibility table. @@ -177,4 +191,12 @@ Acknowledgements received: readiness, outer lifecycle/evidence, rein-local credential resolution, and no-fallback semantics approved with no edits. -Pending: Activity Core, sand-boxer, and llm-connect. +Reviews requiring follow-up: + +- Activity Core — message `428abb02-75dc-450d-a7f6-56fc715409ab`: strategic + route and no-fallback posture confirmed, but acknowledgement withheld until + the shared-caller/current-state limitation, principal-to-`worker_id` target, + Activity-Core-side expired-lease rejection, and explicit break-glass boundary + were recorded. Those edits are incorporated in this revision. + +Pending: revised Activity Core acknowledgement, sand-boxer, and llm-connect. diff --git a/workplans/HARNESS-WP-0003-governed-runtime-integrity.md b/workplans/HARNESS-WP-0003-governed-runtime-integrity.md index 87aca2b..f5dc496 100644 --- a/workplans/HARNESS-WP-0003-governed-runtime-integrity.md +++ b/workplans/HARNESS-WP-0003-governed-runtime-integrity.md @@ -112,6 +112,13 @@ and T02–T06 can cite stable decisions rather than infer ownership from code. - Glas approved the proposed boundary without edits in message `006fa46f-9419-4f61-90ff-0c3b6bc294c1`. Activity Core, sand-boxer, and llm-connect acknowledgements remain pending. +- Activity Core review `428abb02-75dc-450d-a7f6-56fc715409ab` confirmed the + strategic route and no-fallback posture but correctly rejected an overstated + queue-identity guarantee. ADR-002 now distinguishes the current shared caller + token from the required principal-to-`worker_id` binding, requires Activity + Core itself to reject heartbeat/close mutations at or after lease expiry, + and excludes operator/SSO identity except through an audited break-glass + contract. Revised acknowledgement remains pending. ## Make each repository run a lease-bound transaction