Correct metered Sonnet 5 admission and prepare native action packet
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e332-3365-77c0-8491-084e9ea33ac1
This commit is contained in:
parent
46a54acc0c
commit
11cc0d5452
13 changed files with 2111 additions and 3 deletions
694
docs/evidence/2026-09-27-installed-policy-refusal.json
Normal file
694
docs/evidence/2026-09-27-installed-policy-refusal.json
Normal file
|
|
@ -0,0 +1,694 @@
|
|||
{
|
||||
"schema": "metered-activation-review/v1",
|
||||
"status": "review-only",
|
||||
"dispatch_enabled": false,
|
||||
"owner_digest": "46ab4f3fab1c5996ee61c96061b90518d625ffb3fa0966c9bbf7550f422b884b",
|
||||
"policy_review": {
|
||||
"passed": false,
|
||||
"failures": [
|
||||
"input_reservation_below_provider_context",
|
||||
"output_limit_below_observed_cli_request",
|
||||
"observed_cli_beta_not_admitted"
|
||||
],
|
||||
"maximum_request_microusd": 1120000,
|
||||
"maximum_request_eur_at_configured_fx": "0.9744",
|
||||
"full_output_requests_that_fit": 5,
|
||||
"provider_facts_ref": "https://platform.claude.com/docs/en/models/sonnet-5/whats-new-sonnet-5",
|
||||
"authority_granted": false,
|
||||
"remaining_acceptance": [
|
||||
"FX upper bound and validity",
|
||||
"live CLI/beta compatibility",
|
||||
"native delivery and runtime admission"
|
||||
]
|
||||
},
|
||||
"plans": [
|
||||
{
|
||||
"catalog_id": "glas-claude-agent-dev-anthropic",
|
||||
"stage": "prod",
|
||||
"decision_id": "",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"actions": [
|
||||
{
|
||||
"kind": "kv-mount-check",
|
||||
"target": "platform",
|
||||
"detail": {
|
||||
"type": "kv-v2",
|
||||
"management": "existing",
|
||||
"mutation": "none"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "policy",
|
||||
"target": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"detail": {
|
||||
"paths": "platform/data/workloads/glas-harness/claude-agent-dev"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "approle",
|
||||
"target": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"detail": {
|
||||
"token_policies": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"auth": "approle",
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_num_uses": 8,
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1
|
||||
}
|
||||
}
|
||||
],
|
||||
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-glas-claude-agent-dev-anthropic\"\n\npath \"platform/data/workloads/glas-harness/claude-agent-dev\" {\n capabilities = [\"read\"]\n}\n"
|
||||
},
|
||||
{
|
||||
"catalog_id": "activity-core-metered-worker-token",
|
||||
"stage": "prod",
|
||||
"decision_id": "",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"actions": [
|
||||
{
|
||||
"kind": "kv-mount-check",
|
||||
"target": "platform",
|
||||
"detail": {
|
||||
"type": "kv-v2",
|
||||
"management": "existing",
|
||||
"mutation": "none"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "policy",
|
||||
"target": "se-prod-activity-core-metered-worker-token",
|
||||
"detail": {
|
||||
"paths": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "approle",
|
||||
"target": "se-prod-activity-core-metered-worker-token",
|
||||
"detail": {
|
||||
"token_policies": "se-prod-activity-core-metered-worker-token",
|
||||
"auth": "approle",
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_num_uses": 8,
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1
|
||||
}
|
||||
}
|
||||
],
|
||||
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-activity-core-metered-worker-token\"\n\npath \"platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01\" {\n capabilities = [\"read\"]\n}\n"
|
||||
}
|
||||
],
|
||||
"actions": [
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "apply",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "apply",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "verify",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "verify",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "exec",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "exec",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true,
|
||||
"exec_owner_sha256": "46ab4f3fab1c5996ee61c96061b90518d625ffb3fa0966c9bbf7550f422b884b"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "apply",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "apply",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "verify",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "verify",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "exec",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "exec",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"native_evaluator_digests": "not obtained; local hashes are not evaluator digests",
|
||||
"approval_ids": [],
|
||||
"host_pins_verified": false
|
||||
}
|
||||
23
docs/evidence/2026-09-27-metered-host-preflight.json
Normal file
23
docs/evidence/2026-09-27-metered-host-preflight.json
Normal file
|
|
@ -0,0 +1,23 @@
|
|||
{
|
||||
"scope": "read-only host metadata; no credential or queue access",
|
||||
"host": "railiance01",
|
||||
"files": {
|
||||
"owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"mode": "0o600"
|
||||
},
|
||||
"spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"mode": "0o600"
|
||||
}
|
||||
},
|
||||
"ledger_rows": {
|
||||
"reservations": 0,
|
||||
"request_routes": 0,
|
||||
"request_reservations": 0
|
||||
},
|
||||
"secrets_engine_revision": "f7c12bedc8149bbf484065fb58411a9fac706798",
|
||||
"target_head": "679d23e0517707ba63e25399b5262f0d2f37315d",
|
||||
"target_clean": true,
|
||||
"activity_core_forward": "active"
|
||||
}
|
||||
242
docs/evidence/2026-09-27-sonnet5-runtime-proof.json
Normal file
242
docs/evidence/2026-09-27-sonnet5-runtime-proof.json
Normal file
|
|
@ -0,0 +1,242 @@
|
|||
{
|
||||
"scope": "standalone installed packages and real CLI/bwrap; synthetic key/provider/empty queue",
|
||||
"ok": true,
|
||||
"runtime_sha256": "b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969",
|
||||
"proof_script_sha256": "a3cde37c6b1075caaa092248569d9b7a3e37bde467648686d70ac77ef86c89d8",
|
||||
"claude_sha256": "19842705e989393fce936804df6d2ab034860e24b8f8880357981d87ffd83fac",
|
||||
"imports": {
|
||||
"rein_aharness": "lib/python3.12/site-packages/rein_aharness/__init__.py",
|
||||
"llm_connect": "lib/python3.12/site-packages/llm_connect/__init__.py",
|
||||
"glas_harness": "lib/python3.12/site-packages/glas_harness/__init__.py",
|
||||
"sandboxer": "lib/python3.12/site-packages/sandboxer/__init__.py"
|
||||
},
|
||||
"packaged_definitions": true,
|
||||
"positive": {
|
||||
"native_threshold_usd": 1.0,
|
||||
"probe": {
|
||||
"runtime_readonly": true,
|
||||
"python_prefix": "/opt/sandboxer/runtime",
|
||||
"cli_version": "2.1.266 (Claude Code)",
|
||||
"private_absent": true,
|
||||
"source_absent": true,
|
||||
"proxy_absent": true,
|
||||
"interfaces": [
|
||||
"lo"
|
||||
]
|
||||
},
|
||||
"provider_requests": 1,
|
||||
"cli_exit_code": 0,
|
||||
"cli_is_error": false,
|
||||
"cli_estimated_usd": 0.00030000000000000003,
|
||||
"request_reservations": [
|
||||
{
|
||||
"receipt": "5519ba2f-fe1f-4928-8afb-fb765acc1bdc",
|
||||
"run_id": "fixture-run",
|
||||
"policy_sha256": "c72c3a7c69e5224c63beb60f699bbc0c28d93d4b300604cae4208e761a1b4825",
|
||||
"lease_id": "d40ebad662643b376f406fb07bf37671cb99497cc23755e3e8f97cda53b37a29",
|
||||
"liability_microusd": 4640000,
|
||||
"state": "charged",
|
||||
"observed_microusd": 500,
|
||||
"created_at": "2026-09-27T14:55:51.865416+00:00"
|
||||
}
|
||||
],
|
||||
"route_revoked": true,
|
||||
"workspace_removed": true,
|
||||
"bootstrap": {
|
||||
"ok": true,
|
||||
"claimed": false,
|
||||
"empty": true,
|
||||
"run_id": "",
|
||||
"ops_state": null
|
||||
},
|
||||
"profile_ref": "harness.agent-dev-local@1.1.1",
|
||||
"model": "claude-sonnet-5",
|
||||
"request_shapes": [
|
||||
{
|
||||
"model": "claude-sonnet-5",
|
||||
"max_tokens": 64000,
|
||||
"thinking_type": "adaptive",
|
||||
"manual_thinking_budget": false,
|
||||
"sampling_parameters": {},
|
||||
"betas": [
|
||||
"claude-code-20250219",
|
||||
"interleaved-thinking-2025-05-14",
|
||||
"thinking-token-count-2026-05-13",
|
||||
"context-management-2025-06-27",
|
||||
"prompt-caching-scope-2026-01-05",
|
||||
"mid-conversation-system-2026-04-07",
|
||||
"effort-2025-11-24"
|
||||
]
|
||||
}
|
||||
],
|
||||
"policy_context_tokens": 1000000,
|
||||
"admission_requests": [
|
||||
{
|
||||
"model": "claude-sonnet-5",
|
||||
"max_tokens": 64000,
|
||||
"thinking_type": "disabled",
|
||||
"top_level_fields": [
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": [
|
||||
"claude-code-20250219",
|
||||
"interleaved-thinking-2025-05-14",
|
||||
"thinking-token-count-2026-05-13",
|
||||
"context-management-2025-06-27",
|
||||
"prompt-caching-scope-2026-01-05",
|
||||
"mid-conversation-system-2026-04-07",
|
||||
"effort-2025-11-24",
|
||||
"structured-outputs-2025-12-15"
|
||||
],
|
||||
"message_roles": [
|
||||
"user"
|
||||
],
|
||||
"output_config_keys": [
|
||||
"effort",
|
||||
"format"
|
||||
],
|
||||
"output_effort": "high",
|
||||
"refusal": "beta feature not admitted"
|
||||
},
|
||||
{
|
||||
"model": "claude-sonnet-5",
|
||||
"max_tokens": 64000,
|
||||
"thinking_type": "adaptive",
|
||||
"top_level_fields": [
|
||||
"context_management",
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": [
|
||||
"claude-code-20250219",
|
||||
"interleaved-thinking-2025-05-14",
|
||||
"thinking-token-count-2026-05-13",
|
||||
"context-management-2025-06-27",
|
||||
"prompt-caching-scope-2026-01-05",
|
||||
"mid-conversation-system-2026-04-07",
|
||||
"effort-2025-11-24"
|
||||
],
|
||||
"message_roles": [
|
||||
"user"
|
||||
],
|
||||
"output_config_keys": [
|
||||
"effort"
|
||||
],
|
||||
"output_effort": "high"
|
||||
}
|
||||
]
|
||||
},
|
||||
"refused": {
|
||||
"native_threshold_usd": 0.01,
|
||||
"probe": {
|
||||
"runtime_readonly": true,
|
||||
"python_prefix": "/opt/sandboxer/runtime",
|
||||
"cli_version": "2.1.266 (Claude Code)",
|
||||
"private_absent": true,
|
||||
"source_absent": true,
|
||||
"proxy_absent": true,
|
||||
"interfaces": [
|
||||
"lo"
|
||||
]
|
||||
},
|
||||
"provider_requests": 0,
|
||||
"cli_exit_code": 1,
|
||||
"cli_is_error": true,
|
||||
"cli_estimated_usd": 0,
|
||||
"request_reservations": [],
|
||||
"route_revoked": true,
|
||||
"workspace_removed": true,
|
||||
"bootstrap": null,
|
||||
"profile_ref": "harness.agent-dev-local@1.1.1",
|
||||
"model": "claude-sonnet-5",
|
||||
"request_shapes": [],
|
||||
"policy_context_tokens": 1000000,
|
||||
"admission_requests": [
|
||||
{
|
||||
"model": "claude-sonnet-5",
|
||||
"max_tokens": 64000,
|
||||
"thinking_type": "disabled",
|
||||
"top_level_fields": [
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": [
|
||||
"claude-code-20250219",
|
||||
"interleaved-thinking-2025-05-14",
|
||||
"thinking-token-count-2026-05-13",
|
||||
"context-management-2025-06-27",
|
||||
"prompt-caching-scope-2026-01-05",
|
||||
"mid-conversation-system-2026-04-07",
|
||||
"effort-2025-11-24",
|
||||
"structured-outputs-2025-12-15"
|
||||
],
|
||||
"message_roles": [
|
||||
"user"
|
||||
],
|
||||
"output_config_keys": [
|
||||
"effort",
|
||||
"format"
|
||||
],
|
||||
"output_effort": "high",
|
||||
"refusal": "beta feature not admitted"
|
||||
},
|
||||
{
|
||||
"model": "claude-sonnet-5",
|
||||
"max_tokens": 64000,
|
||||
"thinking_type": "adaptive",
|
||||
"top_level_fields": [
|
||||
"context_management",
|
||||
"max_tokens",
|
||||
"messages",
|
||||
"metadata",
|
||||
"model",
|
||||
"output_config",
|
||||
"stream",
|
||||
"system",
|
||||
"thinking",
|
||||
"tools"
|
||||
],
|
||||
"betas": [
|
||||
"claude-code-20250219",
|
||||
"interleaved-thinking-2025-05-14",
|
||||
"thinking-token-count-2026-05-13",
|
||||
"context-management-2025-06-27",
|
||||
"prompt-caching-scope-2026-01-05",
|
||||
"mid-conversation-system-2026-04-07",
|
||||
"effort-2025-11-24"
|
||||
],
|
||||
"message_roles": [
|
||||
"user"
|
||||
],
|
||||
"output_config_keys": [
|
||||
"effort"
|
||||
],
|
||||
"output_effort": "high"
|
||||
}
|
||||
]
|
||||
},
|
||||
"artifact_unchanged": true,
|
||||
"live_factory_attempts": 0
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue