coulomb/secrets-engine
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
secrets-engine/docs/proposals/glas-metered-tool-renewal-20260927/native-pdp-inputs.json
tegwick 97cde1740d
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details
Preserve accepted budget renewal candidate and native action bindings 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a0e387-534d-70e3-ad53-4ea05676db8c
2026-09-27 20:34:53 +02:00

1726 lines
66 KiB
JSON
Raw Blame History

[
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "apply",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "apply",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true
}
},
"decision": {
"id": "decision:055a4c72507e3216",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "apply",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"name": "sand-boxer-glas-agent-dev",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"exec_owner": {
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"env": "ACTIVITY_CORE_WORKER_TOKEN",
"field": "token"
}
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"HOME": "/home/tegwick",
"LANG": "C.UTF-8",
"PATH": "/usr/bin:/bin"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"private": false,
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"private": true,
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"private": true,
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
}
},
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"status": "configured"
}
},
"delivery_modes": [
"exec-env",
"read-check"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/glas-harness/claude-agent-dev",
"repo": "sand-boxer",
"workload_delivery": []
},
"human_control": true,
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
},
"request_digest": "sha256:ad563454ecebe247b34e7b7dd3c06dd851d686624a00f782636a688b1f9069b9",
"submitted_request_digest": "sha256:eefcc2d73f974573d4913434b52cceac68161142935a4d59f9ae9dcf9ca4ccd7"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:01Z",
"expires_at": "2026-09-27T18:38:01Z"
},
"diagnostics": {
"action": "apply",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:973a545e0a06a3b672a0d430268e9308e59e8b7d29b955d28294cc36f3b22955"
},
"decision_time": "2026-09-27T18:23:01Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
},
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "verify",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "verify",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true
}
},
"decision": {
"id": "decision:28e6bd06c550fb5f",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "verify",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"name": "sand-boxer-glas-agent-dev",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"exec_owner": {
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"env": "ACTIVITY_CORE_WORKER_TOKEN",
"field": "token"
}
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"HOME": "/home/tegwick",
"LANG": "C.UTF-8",
"PATH": "/usr/bin:/bin"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"private": false,
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"private": true,
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"private": true,
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
}
},
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"status": "configured"
}
},
"delivery_modes": [
"exec-env",
"read-check"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/glas-harness/claude-agent-dev",
"repo": "sand-boxer",
"workload_delivery": []
},
"human_control": true,
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
},
"request_digest": "sha256:0e45d156c8a2b31789fa6f9431c260ee411d8546c3aeaf50d3ac56d5c4b39139",
"submitted_request_digest": "sha256:6f4ba6f895c418cf7d251f58b3113d569c138b4a0f5c763a5535f9019088b381"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:01Z",
"expires_at": "2026-09-27T18:38:01Z"
},
"diagnostics": {
"action": "verify",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:973a545e0a06a3b672a0d430268e9308e59e8b7d29b955d28294cc36f3b22955"
},
"decision_time": "2026-09-27T18:23:01Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
},
{
"catalog": "glas-claude-agent-dev-anthropic",
"action": "exec",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "exec",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
]
}
},
"context": {
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "sand-boxer",
"mount": "platform",
"path": "workloads/glas-harness/claude-agent-dev",
"fields": [
"ANTHROPIC_API_KEY"
],
"mount_management": "existing",
"consumers": [
{
"name": "sand-boxer-glas-agent-dev",
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_modes": [
"exec-env",
"read-check"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"exec_owner": {
"status": "configured",
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"PATH": "/usr/bin:/bin",
"LANG": "C.UTF-8",
"HOME": "/home/tegwick",
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f",
"private": false
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db",
"private": true
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2",
"private": true
}
},
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"field": "token",
"env": "ACTIVITY_CORE_WORKER_TOKEN"
}
]
}
},
"auth_capability": {},
"workload_delivery": []
},
"human_control": true,
"exec_owner_sha256": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f"
}
},
"decision": {
"id": "decision:a108596dd31cc3d3",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "exec",
"resource": {
"id": "catalog:glas-claude-agent-dev-anthropic",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"policy_targets": [
"se-prod-glas-claude-agent-dev-anthropic"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:glas-claude-agent-dev-anthropic",
"name": "sand-boxer-glas-agent-dev",
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-glas-claude-agent-dev-anthropic",
"role_name": "se-prod-glas-claude-agent-dev-anthropic",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"exec_owner": {
"command": [
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3",
"-I",
"-B",
"-m",
"rein_aharness.cli",
"metered-once",
"--owner-config",
"/home/tegwick/hfact/owner-metered/owner.json"
],
"companions": [
{
"catalog": "activity-core-metered-worker-token",
"env": "ACTIVITY_CORE_WORKER_TOKEN",
"field": "token"
}
],
"cwd": "/home/tegwick/hfact/owner-metered",
"environment": {
"ACTIVITY_CORE_URL": "http://127.0.0.1:8010",
"AGENT_HARNESS_EXECUTION_PROJECT": "prj-helixforge-factory",
"AGENT_HARNESS_OPS_LABELS": "hfact-metered",
"AGENT_HARNESS_OPS_LABELS_MODE": "all",
"AGENT_HARNESS_REPO_MAP": "{\"hfact-glas-proof\":\"/home/tegwick/hfact/targets/hfact-glas-proof\"}",
"AGENT_HARNESS_REQUIRE_REQUEST_ADMISSION": "1",
"AGENT_HARNESS_REQUIRE_SPEND_ADMISSION": "1",
"AGENT_HARNESS_SPEND_LEDGER": "/home/tegwick/hfact/owner-metered/spend-tool-proof-renewal-20260927.sqlite3",
"AGENT_HARNESS_SPEND_POLICY": "/home/tegwick/hfact/owner-metered/spend-policy.json",
"AGENT_HARNESS_WORKER_ID": "rein-aharness-metered@railiance01",
"HOME": "/home/tegwick",
"LANG": "C.UTF-8",
"PATH": "/usr/bin:/bin"
},
"files": {
"/home/tegwick/.helixforge-factory/runtimes/b6e4e8a429393d68831c996a65c0489664205df969ac9882e581983ec2da4969/bin/python3": {
"private": false,
"sha256": "e50d468e8b0adfb05733f5b87b3cff34829c4a8c1aea50c865aa8bdfe4bb150f"
},
"/home/tegwick/hfact/owner-metered/owner.json": {
"private": true,
"sha256": "fed3f80fb451b742bf306e89b6800a742db5cf75d1a6e2ed5556ee204597b9db"
},
"/home/tegwick/hfact/owner-metered/spend-policy.json": {
"private": true,
"sha256": "69ea0071d2cc4311895b1df16039438f7bbc9f6dd3c797af05d4bc845d7afde2"
}
},
"owner": "rein-aharness MessagesOwner (metered-once) with sand-boxer runtime boundary",
"status": "configured"
}
},
"delivery_modes": [
"exec-env",
"read-check"
],
"fields": [
"ANTHROPIC_API_KEY"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/glas-harness/claude-agent-dev",
"repo": "sand-boxer",
"workload_delivery": []
},
"exec_owner_sha256": "310600eab467ed79fc3851178a065de12d57d3ada5bcf68d9c364ed11b3ee50f",
"human_control": true,
"purpose": "Owner-admitted glas-harness agt run through the reviewed local profile; no caller-facing key fetch"
},
"request_digest": "sha256:62686f744536db70a48e17f416be6c32203c48d7d1bb3dbda85afb3f0e3ea0f3",
"submitted_request_digest": "sha256:e4eaa26cdd6687a543d88492bbb3b1b9f8ef2c1f1490d19c1e8e718ef0f30d8e"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:01Z",
"expires_at": "2026-09-27T18:38:01Z"
},
"diagnostics": {
"action": "exec",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:087cf05d952a3297d1eb146679841ff2b37b9c48dd0f79caa907285dbe96d160"
},
"decision_time": "2026-09-27T18:23:01Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "apply",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "apply",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
},
"decision": {
"id": "decision:3b17db5cbd13621d",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "apply",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"name": "rein-aharness-metered-railiance01",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"delivery_modes": [
"exec-env"
],
"fields": [
"token"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"repo": "activity-core",
"workload_delivery": []
},
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
},
"request_digest": "sha256:f8cffb9005b5d267d14ec1a216a785716ad3d611422c94ab52d6d66d3b259d95",
"submitted_request_digest": "sha256:95138b47056338596a689788c61f0f537011a11c5cab38c94c8e2c04f4d68dec"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:01Z",
"expires_at": "2026-09-27T18:38:01Z"
},
"diagnostics": {
"action": "apply",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
},
"decision_time": "2026-09-27T18:23:01Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "verify",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "verify",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
},
"decision": {
"id": "decision:abc00a7202c11ae9",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "verify",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"name": "rein-aharness-metered-railiance01",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"delivery_modes": [
"exec-env"
],
"fields": [
"token"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"repo": "activity-core",
"workload_delivery": []
},
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
},
"request_digest": "sha256:d53ce35084b40ccf92f2e0062185d721ba726323f5b6324ba5884d4fbe2c23c4",
"submitted_request_digest": "sha256:4554023dfb52dee7a9af5aa5164b2edb5d885d07d1e01bd3a8f95a3b5087658a"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:01Z",
"expires_at": "2026-09-27T18:38:01Z"
},
"diagnostics": {
"action": "verify",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
},
"decision_time": "2026-09-27T18:23:01Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
},
{
"catalog": "activity-core-metered-worker-token",
"action": "exec",
"request": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service"
},
"action": "exec",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"attributes": {
"stage": "prod",
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
]
}
},
"context": {
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner",
"catalog_target": {
"kind": "kv",
"org": "coulomb",
"repo": "activity-core",
"mount": "platform",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"fields": [
"token"
],
"mount_management": "existing",
"consumers": [
{
"name": "rein-aharness-metered-railiance01",
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_modes": [
"exec-env"
],
"delivery_auth": {
"method": "approle",
"management": "engine",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"metadata_read": false,
"token_ttl": "5m",
"token_max_ttl": "15m",
"secret_id_ttl": "5m",
"secret_id_num_uses": 1,
"token_num_uses": 8
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"auth_capability": {},
"workload_delivery": []
}
}
},
"decision": {
"id": "decision:38405f0256bfacdc",
"contract_version": "flex-auth.decision-record.v1",
"effect": "allow",
"reason": "catalog_lane_policy_matched",
"matched_policy_version": "v2",
"matched_rule": "catalog_lane_policy_matched",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"binding": {
"tenant": "tenant:platform",
"subject": {
"id": "secrets-engine",
"type": "service",
"tenant": "tenant:platform",
"attributes": {
"description": "secrets-engine's own service identity, the single calling identity for the twelve gated catalog-lane actions it sends to POST /v1/check. Because it is the only subject, the package has no action_not_granted branch (FLEX-WP-0021-T02); registering a second identity is the revisit trigger.",
"display_name": "secrets-engine service principal",
"groups": [
"group:secrets-engine-lane-operators"
],
"organization_relation": "ServiceProvider",
"roles": [
"Operator"
]
}
},
"action": "exec",
"resource": {
"id": "catalog:activity-core-metered-worker-token",
"type": "secret-catalog-lane",
"system": "secrets-engine",
"tenant": "tenant:platform",
"attributes": {
"auth_targets": [
"se-prod-activity-core-metered-worker-token"
],
"fields": [
"token"
],
"policy_targets": [
"se-prod-activity-core-metered-worker-token"
],
"stage": "prod"
}
},
"context": {
"catalog_target": {
"auth_capability": {},
"consumers": [
{
"auth": "approle",
"claim": "catalog:activity-core-metered-worker-token",
"name": "rein-aharness-metered-railiance01",
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
}
],
"delivery_auth": {
"management": "engine",
"metadata_read": false,
"method": "approle",
"policy_name": "se-prod-activity-core-metered-worker-token",
"role_name": "se-prod-activity-core-metered-worker-token",
"secret_id_num_uses": 1,
"secret_id_ttl": "5m",
"token_max_ttl": "15m",
"token_num_uses": 8,
"token_ttl": "5m"
},
"delivery_config": {
"companion_of": [
"glas-claude-agent-dev-anthropic"
]
},
"delivery_modes": [
"exec-env"
],
"fields": [
"token"
],
"kind": "kv",
"mount": "platform",
"mount_management": "existing",
"org": "coulomb",
"path": "workloads/activity-core/ops-run-workers/rein-aharness-metered-railiance01",
"repo": "activity-core",
"workload_delivery": []
},
"purpose": "Claim the admitted hfact-metered ops_run as rein-aharness-metered@railiance01 inside the catalog-bound Glas metered owner"
},
"request_digest": "sha256:93b12e31b0323a21ae310fced3add0b887658e64530f2e4bc65130ebbd6d9a3d",
"submitted_request_digest": "sha256:ad628079debc7e46937b58e68cf6784802e2865e039b98aa25d77fb40be3ed36"
},
"lifetime": {
"kind": "ttl",
"ttl": "15m",
"not_before": "2026-09-27T18:23:02Z",
"expires_at": "2026-09-27T18:38:02Z"
},
"diagnostics": {
"action": "exec",
"matched_relationship": "",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_status": "ready",
"registry_overrode": [],
"registry_resource": false,
"registry_subject": true
},
"provenance": {
"evaluator": "flex-auth/local",
"mode": "standalone",
"policy_package": "secrets-engine.catalog-lane.lifecycle",
"policy_version": "v2",
"policy_package_digest": "sha256:bd11c5fe77ce6439c65fea225ad6b71d2110efc5e7b5bc9b499c59cd0a53b8b4",
"registry_snapshot_digest": "sha256:f5a309bc0b36721fd6d9ad7f53eb21222162bc2eac62a0ab0802a9a1d51340bb",
"input_claim_digests": {
"context": "sha256:ca775aea253f9f67f99b5729cf6068cf2d81908ceb00fc11e73149e59c616df8"
},
"decision_time": "2026-09-27T18:23:02Z"
},
"caring": {
"profile": "caring-0.4.0-rc2",
"conformance_findings": [
{
"code": "CARING-DESCRIPTOR-MISSING",
"severity": "warning",
"message": "no CARING descriptor matched the request",
"fields": [
"caring_context"
]
}
]
}
}
}
]
Reference in a new issue View git blame Copy permalink