coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Draft configured Glas exec_owner with metered worker companion

Browse source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 226514@bnt-lap001
Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6
This commit is contained in:
tegwick 2026-09-23 18:38:11 +02:00
parent d06aea33bc
commit a0e39cbd53
2 changed files with 58 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
workplans/SECRETS-WP-0009-glas-claude-native-delivery.md
View file

@ -467,3 +467,20 @@ approval URLs must be literal loopback or HTTPS (`decision_check.py:73`,
`approval_auth.py:90`), so the attended session needs host-side
`kubectl port-forward` to 127.0.0.1 for both. That is a session step, not a
standing change.
### 2026-09-23 metered owner provisioned; exec_owner drafted
Operator provisioned `~/hfact/owner-metered` on railiance01: spend policy
`a8ab3729…`, owner config `0e263f82…`, valid from 2026-09-23T16:36:52Z. The
owner `--check` passes under `rein-aharness-metered@railiance01` with runtime
`b6e4e8a4`. No key, no claim, dispatch disabled.
The configured binding is drafted in `docs/drafts/glas-exec-owner-configured.yaml`.
It pins the runtime python and the owner config, uses cwd `~/hfact/owner-metered`,
a fixed non-secret environment, and the companion
`activity-core-metered-worker-token` → `ACTIVITY_CORE_WORKER_TOKEN`. It validates
with the catalog code, and the real pin and path-safety checks pass on
railiance01 (owner digest `00b5f076…`). The catalog stays `pending` until
ACTIVITY-WP-0039 seeds the metered token and rolls out. `ACTIVITY_CORE_URL`
assumes the host `actcore-api-port-forward` service on 127.0.0.1:8010; check
that it answers before the attended session.