1727 lines
66 KiB
JSON
1727 lines
66 KiB
JSON
|
[
|
||
|
|
{
|
||
|
|
"catalog": "glas-claude-agent-dev-anthropic",
|
||
|
|
"action": "apply",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "apply",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"status": "configured",
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"PATH": "/usr/bin:/bin",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||
|
|
"private": false
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f",
|
||
|
|
"private": true
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42",
|
||
|
|
"private": true
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"field": "token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"human_control": true
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:3b5cac60f8edcb18",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "apply",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN",
|
||
|
|
"field": "token"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"PATH": "/usr/bin:/bin"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"private": false,
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"status": "configured"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"human_control": true,
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:23be0d6e92d6598579358e0d630abc317b7b5a30eb66c3b7c643eb3b5a9b9881",
|
||
|
|
"submitted_request_digest": "sha256:7c90f7155b255f00ae5341b7a83ab564714dfcc7d6b00ef66fa03677369ba186"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:34Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:34Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "apply",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:a1f892dc743dc82558cd64a3cb4e426c0a0f6eb56e2e3ac00dbde4e53db3b5eb"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:34Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"catalog": "glas-claude-agent-dev-anthropic",
|
||
|
|
"action": "verify",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "verify",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"status": "configured",
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"PATH": "/usr/bin:/bin",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||
|
|
"private": false
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f",
|
||
|
|
"private": true
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42",
|
||
|
|
"private": true
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"field": "token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"human_control": true
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:398b9d4873566195",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "verify",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN",
|
||
|
|
"field": "token"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"PATH": "/usr/bin:/bin"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"private": false,
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"status": "configured"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"human_control": true,
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:8233ef77a0f4be71b7b173f6c3feec8042ca0b11d14d96c022ea1177e34a512a",
|
||
|
|
"submitted_request_digest": "sha256:a653462a43205857eec118d659c5c2aadcc80eb3f641a28d6cbfaa5c0a8836a3"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:34Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:34Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "verify",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:a1f892dc743dc82558cd64a3cb4e426c0a0f6eb56e2e3ac00dbde4e53db3b5eb"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:34Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"catalog": "glas-claude-agent-dev-anthropic",
|
||
|
|
"action": "exec",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "exec",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"status": "configured",
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"PATH": "/usr/bin:/bin",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||
|
|
"private": false
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f",
|
||
|
|
"private": true
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42",
|
||
|
|
"private": true
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"field": "token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"human_control": true,
|
||
|
|
"exec_owner_sha256": "20192889bb59f34875ca454776bd7fd162877e8a26924c2973104d2e8cbf3d39"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:85b56ebd4366659f",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "exec",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-glas-claude-agent-dev-anthropic"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||
|
|
"name": "sand-boxer-glas-agent-dev",
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"exec_owner": {
|
||
|
|
"command": [
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||
|
|
"-I",
|
||
|
|
"-B",
|
||
|
|
"-m",
|
||
|
|
"rein_aharness.cli",
|
||
|
|
"metered-once",
|
||
|
|
"--owner-config",
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json"
|
||
|
|
],
|
||
|
|
"companions": [
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"env": "ACTIVITY_CORE_WORKER_TOKEN",
|
||
|
|
"field": "token"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"cwd": "/home/tegwick/hfact/owner-metered",
|
||
|
|
"environment": {
|
||
|
|
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||
|
|
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||
|
|
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||
|
|
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
|
||
|
|
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||
|
|
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-20260927.sqlite3",
|
||
|
|
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||
|
|
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||
|
|
"HOME": "/home/tegwick",
|
||
|
|
"LANG": "C.UTF-8",
|
||
|
|
"PATH": "/usr/bin:/bin"
|
||
|
|
},
|
||
|
|
"files": {
|
||
|
|
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||
|
|
"private": false,
|
||
|
|
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "0f61b428676f08b22856be7426d86270830d08606a46049d1354dfadd551722f"
|
||
|
|
},
|
||
|
|
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||
|
|
"private": true,
|
||
|
|
"sha256": "a9cd136885e7aa394cc937e52ac25bf25aaac3eb470bdabca0880f8127be2e42"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||
|
|
"status": "configured"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env",
|
||
|
|
"read-check"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"ANTHROPIC_API_KEY"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/glas-harness/claude-agent-dev",
|
||
|
|
"repo": "sand-boxer",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"exec_owner_sha256": "20192889bb59f34875ca454776bd7fd162877e8a26924c2973104d2e8cbf3d39",
|
||
|
|
"human_control": true,
|
||
|
|
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:a3dee75819310b039c07d9075dad601f98604370a2f4a8b9a506758b3134da58",
|
||
|
|
"submitted_request_digest": "sha256:5280dffe717b95d7a3e7d06a8d6a8213cdfc8a968cb27f6f24aa0aff3818b7af"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:34Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:34Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "exec",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:0cfb5ad0d231e89de43025006a4ae19ad3248fb64415d114406e217c7ab9d0ff"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:34Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"action": "apply",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "apply",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:3b17db5cbd13621d",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "apply",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:f8cffb9005b5d267d14ec1a216a785716ad3d611422c94ab52d6d66d3b259d95",
|
||
|
|
"submitted_request_digest": "sha256:95138b47056338596a689788c61f0f537011a11c5cab38c94c8e2c04f4d68dec"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:34Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:34Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "apply",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:34Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"action": "verify",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "verify",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:abc00a7202c11ae9",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "verify",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:d53ce35084b40ccf92f2e0062185d721ba726323f5b6324ba5884d4fbe2c23c4",
|
||
|
|
"submitted_request_digest": "sha256:4554023dfb52dee7a9af5aa5164b2edb5d885d07d1e01bd3a8f95a3b5087658a"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:35Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:35Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "verify",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:35Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
{
|
||
|
|
"catalog": "activity-core-metered-worker-token",
|
||
|
|
"action": "exec",
|
||
|
|
"request": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service"
|
||
|
|
},
|
||
|
|
"action": "exec",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"attributes": {
|
||
|
|
"stage": "prod",
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||
|
|
"catalog_target": {
|
||
|
|
"kind": "kv",
|
||
|
|
"org": "coulomb",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"mount": "platform",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"mount_management": "existing",
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"method": "approle",
|
||
|
|
"management": "engine",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"metadata_read": false,
|
||
|
|
"token_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"token_num_uses": 8
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"auth_capability": {},
|
||
|
|
"workload_delivery": []
|
||
|
|
}
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"decision": {
|
||
|
|
"id": "decision:38405f0256bfacdc",
|
||
|
|
"contract_version": "flex-auth.decision-record.v1",
|
||
|
|
"effect": "allow",
|
||
|
|
"reason": "catalog_lane_policy_matched",
|
||
|
|
"matched_policy_version": "v2",
|
||
|
|
"matched_rule": "catalog_lane_policy_matched",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"binding": {
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"subject": {
|
||
|
|
"id": "secrets-engine",
|
||
|
|
"type": "service",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
|
||
|
|
"display_name": "secrets-engine service principal",
|
||
|
|
"groups": [
|
||
|
|
"group:secrets-engine-lane-operators"
|
||
|
|
],
|
||
|
|
"organization_relation": "ServiceProvider",
|
||
|
|
"roles": [
|
||
|
|
"Operator"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"action": "exec",
|
||
|
|
"resource": {
|
||
|
|
"id": "catalog:activity-core-metered-worker-token",
|
||
|
|
"type": "secret-catalog-lane",
|
||
|
|
"system": "secrets-engine",
|
||
|
|
"tenant": "tenant:platform",
|
||
|
|
"attributes": {
|
||
|
|
"auth_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"policy_targets": [
|
||
|
|
"se-prod-activity-core-metered-worker-token"
|
||
|
|
],
|
||
|
|
"stage": "prod"
|
||
|
|
}
|
||
|
|
},
|
||
|
|
"context": {
|
||
|
|
"catalog_target": {
|
||
|
|
"auth_capability": {},
|
||
|
|
"consumers": [
|
||
|
|
{
|
||
|
|
"auth": "approle",
|
||
|
|
"claim": "catalog:activity-core-metered-worker-token",
|
||
|
|
"name": "rein-aharness-metered-railiance01",
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
}
|
||
|
|
],
|
||
|
|
"delivery_auth": {
|
||
|
|
"management": "engine",
|
||
|
|
"metadata_read": false,
|
||
|
|
"method": "approle",
|
||
|
|
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"role_name": "se-prod-activity-core-metered-worker-token",
|
||
|
|
"secret_id_num_uses": 1,
|
||
|
|
"secret_id_ttl": "5m",
|
||
|
|
"token_max_ttl": "15m",
|
||
|
|
"token_num_uses": 8,
|
||
|
|
"token_ttl": "5m"
|
||
|
|
},
|
||
|
|
"delivery_config": {
|
||
|
|
"companion_of": [
|
||
|
|
"glas-claude-agent-dev-anthropic"
|
||
|
|
]
|
||
|
|
},
|
||
|
|
"delivery_modes": [
|
||
|
|
"exec-env"
|
||
|
|
],
|
||
|
|
"fields": [
|
||
|
|
"token"
|
||
|
|
],
|
||
|
|
"kind": "kv",
|
||
|
|
"mount": "platform",
|
||
|
|
"mount_management": "existing",
|
||
|
|
"org": "coulomb",
|
||
|
|
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||
|
|
"repo": "activity-core",
|
||
|
|
"workload_delivery": []
|
||
|
|
},
|
||
|
|
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||
|
|
},
|
||
|
|
"request_digest": "sha256:93b12e31b0323a21ae310fced3add0b887658e64530f2e4bc65130ebbd6d9a3d",
|
||
|
|
"submitted_request_digest": "sha256:ad628079debc7e46937b58e68cf6784802e2865e039b98aa25d77fb40be3ed36"
|
||
|
|
},
|
||
|
|
"lifetime": {
|
||
|
|
"kind": "ttl",
|
||
|
|
"ttl": "15m",
|
||
|
|
"not_before": "2026-09-27T16:52:35Z",
|
||
|
|
"expires_at": "2026-09-27T17:07:35Z"
|
||
|
|
},
|
||
|
|
"diagnostics": {
|
||
|
|
"action": "exec",
|
||
|
|
"matched_relationship": "",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_status": "ready",
|
||
|
|
"registry_overrode": [],
|
||
|
|
"registry_resource": false,
|
||
|
|
"registry_subject": true
|
||
|
|
},
|
||
|
|
"provenance": {
|
||
|
|
"evaluator": "flex-auth/local",
|
||
|
|
"mode": "standalone",
|
||
|
|
"policy_package": "secrets-engine.catalog-lane.lifecycle",
|
||
|
|
"policy_version": "v2",
|
||
|
|
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
|
||
|
|
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
|
||
|
|
"input_claim_digests": {
|
||
|
|
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
|
||
|
|
},
|
||
|
|
"decision_time": "2026-09-27T16:52:35Z"
|
||
|
|
},
|
||
|
|
"caring": {
|
||
|
|
"profile": "caring-0.4.0-rc2",
|
||
|
|
"conformance_findings": [
|
||
|
|
{
|
||
|
|
"code": "CARING-DESCRIPTOR-MISSING",
|
||
|
|
"severity": "warning",
|
||
|
|
"message": "no CARING descriptor matched the request",
|
||
|
|
"fields": [
|
||
|
|
"caring_context"
|
||
|
|
]
|
||
|
|
}
|
||
|
|
]
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
]
|