coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/proposals/glas-metered-tool-renewal-20260927/activation-review.json
tegwick 97cde1740d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Preserve accepted budget renewal candidate and native action bindings 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
2026-09-27 20:34:53 +02:00

690 lines
26 KiB
JSON
Raw Blame History

{
"schema": "metered-activation-review/v1",
"status": "review-only",
"dispatch_enabled": false,
"owner_digest": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f",
"policy_review": {
"passed": true,
"failures": [],
"maximum_request_microusd": 4640000,
"maximum_request_eur_at_configured_fx": "4.64",
"full_output_requests_that_fit": 2,
"provider_facts_ref": "https://platform.claude.com/docs/en/models/sonnet-5/whats-new-sonnet-5",
"authority_granted": false,
"remaining_acceptance": [
"FX upper bound and validity",
"live CLI/beta compatibility",
"native delivery and runtime admission"
]
},
"plans": [
{
"catalog_id": "glas-claude-agent-dev-anthropic",
"stage": "prod",
"decision_id": "",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"actions": [
{
"kind": "kv-mount-check",
"target": "platform",
"detail": {
"type": "kv-v2",
"management": "existing",
"mutation": "none"
}
},
{
"kind": "policy",
"target": "se-prod-glas-claude-agent-dev-anthropic",
"detail": {
"paths": "platform/data/workloads/glas-harness/claude-agent-dev"
}
},
{
"kind": "approle",
"target": "se-prod-glas-claude-agent-dev-anthropic",
"detail": {
"token_policies": "se-prod-glas-claude-agent-dev-anthropic",
"auth": "approle",
"token_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"secret_id_ttl": "5m",
"secret_id_num_uses": 1
}
}
],
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-glas-claude-agent-dev-anthropic\"\n\npath \"platform/data/workloads/glas-harness/claude-agent-dev\" {\n capabilities = [\"read\"]\n}\n"
},
{
"catalog_id": "activity-core-metered-worker-token",
"stage": "prod",
"decision_id": "",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"actions": [
{
"kind": "kv-mount-check",
"target": "platform",
"detail": {
"type": "kv-v2",
"management": "existing",
"mutation": "none"
}
},
{
"kind": "policy",
"target": "se-prod-activity-core-metered-worker-token",
"detail": {
"paths": "platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01"
}
},
{
"kind": "approle",
"target": "se-prod-activity-core-metered-worker-token",
"detail": {
"token_policies": "se-prod-activity-core-metered-worker-token",
"auth": "approle",
"token_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"secret_id_ttl": "5m",
"secret_id_num_uses": 1
}
}
],
"policy_hcl": "# Generated by secrets-engine for policy \"se-prod-activity-core-metered-worker-token\"\n\npath \"platform/data/workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01\" {\n capabilities = [\"read\"]\n}\n"
}
],
"actions": [
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "apply",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "apply",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true
}
}
},
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "verify",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "verify",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true
}
}
},
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "exec",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "exec",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true,
"exec_owner_sha256": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f"
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "apply",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "apply",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "verify",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "verify",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "exec",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "exec",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
}
}
],
"native_evaluator_digests": "not obtained; local hashes are not evaluator digests",
"approval_ids": [],
"host_pins_verified": false
}
Reference in a new issue View git blame Copy permalink