From cd7d6922d7d6ff78c7fa39497bbcf74ea5ed1988 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 17:49:40 +0200 Subject: [PATCH] Catalog activity-core metered worker-token companion lane (SECRETS-WP-0011-T04) Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 226514@bnt-lap001 Assistant-Session: 26ba103d-05fe-45a1-9cd7-9475bf239df6 --- .../activity-core-metered-worker-token.yaml | 63 +++++++++++++++++++ ...-WP-0011-multi-lane-exec-owner-delivery.md | 14 ++++- 2 files changed, 76 insertions(+), 1 deletion(-) create mode 100644 catalog/activity-core-metered-worker-token.yaml diff --git a/catalog/activity-core-metered-worker-token.yaml b/catalog/activity-core-metered-worker-token.yaml new file mode 100644 index 0000000..74a011e --- /dev/null +++ b/catalog/activity-core-metered-worker-token.yaml @@ -0,0 +1,63 @@ +id: activity-core-metered-worker-token +kind: kv +org: coulomb +repo: activity-core +stage: prod +description: Activity Core queue token for rein-aharness-metered@railiance01, + delivered only as a companion of the Glas metered owner. Custody and issuance + are activity-core's (ACTIVITY-WP-0039); secrets-engine only reads. +mount: platform +path: workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01 +mount_management: existing +fields: +- token +consumers: +- name: rein-aharness-metered-railiance01 + auth: approle + claim: catalog:activity-core-metered-worker-token + purpose: Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 + inside the catalog-bound Glas metered owner +workload_delivery: [] +delivery_config: + companion_of: + - glas-claude-agent-dev-anthropic +delivery_modes: +- exec-env +delivery_auth: + method: approle + management: engine + policy_name: se-prod-activity-core-metered-worker-token + role_name: se-prod-activity-core-metered-worker-token + metadata_read: false + token_ttl: 5m + token_max_ttl: 15m + secret_id_ttl: 5m + secret_id_num_uses: 1 + token_num_uses: 8 +approval: + model: decision + decision_ref: ACTIVITY-WP-0039 + notes: Ordinary lane approval, no human control (operator decision 2026-09-23, + SECRETS-WP-0011). Native apply and exec still need per-lane claim, PDP decision + and consume. This entry is not authorization. +verification: + positive: Exact scoped AppRole reads only token, delivered as ACTIVITY_CORE_WORKER_TOKEN + into the bound Glas metered owner. + negative: The claim-loop worker path, sibling KV, metadata, listing and writes denied; + the Glas lane AppRole cannot read this path. +risk: + classification: standard + notes: Lets the holder claim, heartbeat and close ops_runs as the metered identity + only. No provider spend by itself. +rotation: + owner: activity-core + expectation: Mint a new value at the same path via ACTIVITY-WP-0039 procedure; ESO + resyncs actcore-runtime-secret; next exec reads the new value. + ttl: owner-defined +deactivation: + owner: activity-core + expectation: Remove the identity from ACTIVITY_CORE_WORKERS and the path; revoke + the se-prod AppRole and policy. +audit: + evidence: Lane id, companion primary, actor, exact path, field name, timestamps, + and pass/fail only diff --git a/workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md b/workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md index 6a6dd68..98f0ced 100644 --- a/workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md +++ b/workplans/SECRETS-WP-0011-multi-lane-exec-owner-delivery.md @@ -93,7 +93,7 @@ a throwaway OpenBao dev server. id: SECRETS-WP-0011-T04 status: wait priority: high -blocking_reason: "Needs activity-core owner assent to source ACTIVITY_CORE_WORKER_TOKEN from OpenBao (ESO) instead of a hand-generated Kubernetes Secret." +blocking_reason: "Lane cataloged. Waits on ACTIVITY-WP-0039 T02-T04: railiance-platform store policy, founder-attended seeding of the metered token, and activity-core rollout." state_hub_task_id: "cf465065-de7a-5d9c-bc80-fee16ffef70d" ``` @@ -115,3 +115,15 @@ redacts every value. Suite: 465 passed. Integration on a throwaway OpenBao: 2 passed (two lanes to one owner; the primary AppRole is denied the companion path). Contract: `docs/exec-owner-binding.md` § Companion lanes. T04 waits on activity-core (hub message `6e694682`). + +## activity-core return — 2026-09-23 + +Accepted under ACTIVITY-WP-0039 (hub `053ef7c6`). activity-core `b4a7a84` adds +`ACTIVITY_CORE_WORKERS`: one token per identity, no shared token, no fallback. +The dedicated identity is `rein-aharness-metered@railiance01`, with its token at +`platform/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01` +(field `token`), seeded fresh. Not deployed yet. + +Cataloged as `activity-core-metered-worker-token` (prod, standard risk, +`companion_of: [glas-claude-agent-dev-anthropic]`, ordinary `decision` +approval). Not applied. Suite: 467 passed.