Correct metered Sonnet 5 admission and prepare native action packet
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0e332-3365-77c0-8491-084e9ea33ac1
This commit is contained in:
parent
46a54acc0c
commit
11cc0d5452
13 changed files with 2111 additions and 3 deletions
694
docs/evidence/2026-09-27-installed-policy-refusal.json
Normal file
694
docs/evidence/2026-09-27-installed-policy-refusal.json
Normal file
|
|
@ -0,0 +1,694 @@
|
|||
{
|
||||
"schema": "metered-activation-review/v1",
|
||||
"status": "review-only",
|
||||
"dispatch_enabled": false,
|
||||
"owner_digest": "46ab4f3fab1c5996ee61c96061b90518d625ffb3fa0966c9bbf7550f422b884b",
|
||||
"policy_review": {
|
||||
"passed": false,
|
||||
"failures": [
|
||||
"input_reservation_below_provider_context",
|
||||
"output_limit_below_observed_cli_request",
|
||||
"observed_cli_beta_not_admitted"
|
||||
],
|
||||
"maximum_request_microusd": 1120000,
|
||||
"maximum_request_eur_at_configured_fx": "0.9744",
|
||||
"full_output_requests_that_fit": 5,
|
||||
"provider_facts_ref": "https://platform.claude.com/docs/en/models/sonnet-5/whats-new-sonnet-5",
|
||||
"authority_granted": false,
|
||||
"remaining_acceptance": [
|
||||
"FX upper bound and validity",
|
||||
"live CLI/beta compatibility",
|
||||
"native delivery and runtime admission"
|
||||
]
|
||||
},
|
||||
"plans": [
|
||||
{
|
||||
"catalog_id": "glas-claude-agent-dev-anthropic",
|
||||
"stage": "prod",
|
||||
"decision_id": "",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"actions": [
|
||||
{
|
||||
"kind": "kv-mount-check",
|
||||
"target": "platform",
|
||||
"detail": {
|
||||
"type": "kv-v2",
|
||||
"management": "existing",
|
||||
"mutation": "none"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "policy",
|
||||
"target": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"detail": {
|
||||
"paths": "platform/data/workloads/glas-harness/claude-agent-dev"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "approle",
|
||||
"target": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"detail": {
|
||||
"token_policies": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"auth": "approle",
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_num_uses": 8,
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1
|
||||
}
|
||||
}
|
||||
],
|
||||
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-glas-claude-agent-dev-anthropic\"\n\npath \"platform/data/workloads/glas-harness/claude-agent-dev\" {\n capabilities = [\"read\"]\n}\n"
|
||||
},
|
||||
{
|
||||
"catalog_id": "activity-core-metered-worker-token",
|
||||
"stage": "prod",
|
||||
"decision_id": "",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"actions": [
|
||||
{
|
||||
"kind": "kv-mount-check",
|
||||
"target": "platform",
|
||||
"detail": {
|
||||
"type": "kv-v2",
|
||||
"management": "existing",
|
||||
"mutation": "none"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "policy",
|
||||
"target": "se-prod-activity-core-metered-worker-token",
|
||||
"detail": {
|
||||
"paths": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01"
|
||||
}
|
||||
},
|
||||
{
|
||||
"kind": "approle",
|
||||
"target": "se-prod-activity-core-metered-worker-token",
|
||||
"detail": {
|
||||
"token_policies": "se-prod-activity-core-metered-worker-token",
|
||||
"auth": "approle",
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"token_num_uses": 8,
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1
|
||||
}
|
||||
}
|
||||
],
|
||||
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-activity-core-metered-worker-token\"\n\npath \"platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01\" {\n capabilities = [\"read\"]\n}\n"
|
||||
}
|
||||
],
|
||||
"actions": [
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "apply",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "apply",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "verify",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "verify",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "glas-claude-agent-dev-anthropic",
|
||||
"action": "exec",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "exec",
|
||||
"resource": {
|
||||
"id": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "sand-boxer",
|
||||
"mount": "platform",
|
||||
"path": "workloads/glas-harness/claude-agent-dev",
|
||||
"fields": [
|
||||
"ANTHROPIC_API_KEY"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "sand-boxer-glas-agent-dev",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:glas-claude-agent-dev-anthropic",
|
||||
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env",
|
||||
"read-check"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"exec_owner": {
|
||||
"status": "configured",
|
||||
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
|
||||
"command": [
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
|
||||
"-I",
|
||||
"-B",
|
||||
"-m",
|
||||
"rein_aharness.cli",
|
||||
"metered-once",
|
||||
"--owner-config",
|
||||
"/home/tegwick/hfact/owner-metered/owner.json"
|
||||
],
|
||||
"cwd": "/home/tegwick/hfact/owner-metered",
|
||||
"environment": {
|
||||
"PATH": "/usr/bin:/bin",
|
||||
"LANG": "C.UTF-8",
|
||||
"HOME": "/home/tegwick",
|
||||
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
|
||||
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
|
||||
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
|
||||
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
|
||||
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
|
||||
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
|
||||
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
|
||||
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
|
||||
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend.sqlite3",
|
||||
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
|
||||
},
|
||||
"files": {
|
||||
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
|
||||
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
|
||||
"private": false
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/owner.json": {
|
||||
"sha256": "0e263f8299a42f63caf3595ff3eb7adc10354673f7b5125e0811def3bea7c274",
|
||||
"private": true
|
||||
},
|
||||
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
|
||||
"sha256": "f31c585916de1ea8bd8e48c72421803dfde1015e6201704b9320f77d2c545d9c",
|
||||
"private": true
|
||||
}
|
||||
},
|
||||
"companions": [
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"field": "token",
|
||||
"env": "ACTIVITY_CORE_WORKER_TOKEN"
|
||||
}
|
||||
]
|
||||
}
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
},
|
||||
"human_control": true,
|
||||
"exec_owner_sha256": "46ab4f3fab1c5996ee61c96061b90518d625ffb3fa0966c9bbf7550f422b884b"
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "apply",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "apply",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "verify",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "verify",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"catalog": "activity-core-metered-worker-token",
|
||||
"action": "exec",
|
||||
"request": {
|
||||
"tenant": "tenant:platform",
|
||||
"subject": {
|
||||
"id": "secrets-engine",
|
||||
"type": "service"
|
||||
},
|
||||
"action": "exec",
|
||||
"resource": {
|
||||
"id": "catalog:activity-core-metered-worker-token",
|
||||
"type": "secret-catalog-lane",
|
||||
"system": "secrets-engine",
|
||||
"attributes": {
|
||||
"stage": "prod",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"policy_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
],
|
||||
"auth_targets": [
|
||||
"se-prod-activity-core-metered-worker-token"
|
||||
]
|
||||
}
|
||||
},
|
||||
"context": {
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
|
||||
"catalog_target": {
|
||||
"kind": "kv",
|
||||
"org": "coulomb",
|
||||
"repo": "activity-core",
|
||||
"mount": "platform",
|
||||
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
|
||||
"fields": [
|
||||
"token"
|
||||
],
|
||||
"mount_management": "existing",
|
||||
"consumers": [
|
||||
{
|
||||
"name": "rein-aharness-metered-railiance01",
|
||||
"auth": "approle",
|
||||
"claim": "catalog:activity-core-metered-worker-token",
|
||||
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
|
||||
}
|
||||
],
|
||||
"delivery_modes": [
|
||||
"exec-env"
|
||||
],
|
||||
"delivery_auth": {
|
||||
"method": "approle",
|
||||
"management": "engine",
|
||||
"policy_name": "se-prod-activity-core-metered-worker-token",
|
||||
"role_name": "se-prod-activity-core-metered-worker-token",
|
||||
"metadata_read": false,
|
||||
"token_ttl": "5m",
|
||||
"token_max_ttl": "15m",
|
||||
"secret_id_ttl": "5m",
|
||||
"secret_id_num_uses": 1,
|
||||
"token_num_uses": 8
|
||||
},
|
||||
"delivery_config": {
|
||||
"companion_of": [
|
||||
"glas-claude-agent-dev-anthropic"
|
||||
]
|
||||
},
|
||||
"auth_capability": {},
|
||||
"workload_delivery": []
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
],
|
||||
"native_evaluator_digests": "not obtained; local hashes are not evaluator digests",
|
||||
"approval_ids": [],
|
||||
"host_pins_verified": false
|
||||
}
|
||||
Loading…
Add table
Add a link
Reference in a new issue