tegwick
0b473c1bda
T02: additive migration d5e6f7a8b9c0 (decision_class, memo_id,
approval_id, resolution_source, resolution_evidence, evidence_refs,
CHECKs, partial unique memo_id); typed evidence_refs; 409
evidence_required for text resolve, resolving PATCH fields and resolved
create on C1/C2; raise-only class; C3 refused as reserved.
T03: POST /decisions/{id}/resolve-evidence (link/resolve), projected
token verified by TokenReview with audience
state-hub-decision-writeback and an exact subject allowlist; outcome
record v1 validation, 8 KiB bound, secret scan; idempotent on
(decision_id, memo_id). Off by default (DECISION_WRITEBACK_ENABLED).
Tests use a fake reviewer; full suite 1286 passed.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5502@bnt-lap001
Assistant-Session: 68b3b02f-5d0f-4e71-8421-796f62e50196
57 lines
2.9 KiB
Python
57 lines
2.9 KiB
Python
from typing import Literal
|
|
|
|
from pydantic_settings import BaseSettings, SettingsConfigDict
|
|
|
|
|
|
class Settings(BaseSettings):
|
|
model_config = SettingsConfigDict(
|
|
env_file=".env",
|
|
env_file_encoding="utf-8",
|
|
extra="ignore",
|
|
)
|
|
|
|
database_url: str = "postgresql+asyncpg://custodian:changeme@127.0.0.1:5432/custodian"
|
|
api_base: str = "http://127.0.0.1:8000"
|
|
# What this instance claims to be. Deliberately defaults to "unknown":
|
|
# an instance that has not declared itself is not the primary, and callers
|
|
# that need the authoritative hub must be able to tell the difference.
|
|
# Answering on a port is not evidence of authority — that assumption cost
|
|
# seven weeks of onboarding (CUST-WP-0067-T03, ADR-010).
|
|
state_hub_instance_role: Literal["primary", "cache", "unknown"] = "unknown"
|
|
# Env vars are STATE_HUB_INSTANCE_ROLE / STATE_HUB_INSTANCE_LABEL — the
|
|
# field name *is* the binding, so renaming either breaks the deployment
|
|
# silently. Covered by tests/test_instance_identity.py.
|
|
# Free-form label to name *which* instance answered, e.g. "railiance01".
|
|
state_hub_instance_label: str | None = None
|
|
debug: bool = False
|
|
state_hub_report_dir: str = "reports/recently-on-scope"
|
|
state_hub_markitect_cli_path: str | None = None
|
|
activity_core_url: str | None = None
|
|
activity_core_worker_token: str | None = None
|
|
ops_run_projection_ttl_seconds: float = 15.0
|
|
ops_run_sla_hours: float = 1.0
|
|
sbom_nexus_url: str | None = None
|
|
sbom_nexus_read_mode: Literal["legacy", "nexus"] = "legacy"
|
|
sbom_nexus_write_mode: Literal["legacy", "nexus"] = "legacy"
|
|
sbom_nexus_timeout_seconds: float = 5.0
|
|
# Repository renames are central-only, compare-and-set operations. The
|
|
# secret signs short-lived, non-persistent preflight evidence; it must be
|
|
# supplied by the deployment (normally through OpenBao), never recorded in
|
|
# State Hub. With no secret the read-only report remains available but no
|
|
# mutation token can be issued.
|
|
repository_rename_preflight_secret: str | None = None
|
|
repository_rename_preflight_ttl_seconds: int = 900
|
|
repository_rename_forge_timeout_seconds: float = 10.0
|
|
# STATE-WP-0101-T03: authenticated decision write-back route
|
|
# (POST /decisions/{id}/resolve-evidence). Off by default; enabling it needs
|
|
# the API ServiceAccount bound to system:auth-delegator (founder-run, cluster
|
|
# RBAC) so TokenReview works. Subjects: comma-separated exact allowlist.
|
|
decision_writeback_enabled: bool = False
|
|
decision_writeback_audience: str = "state-hub-decision-writeback"
|
|
decision_writeback_subjects: str = "system:serviceaccount:state-hub:state-hub"
|
|
kubernetes_api_url: str = "https://kubernetes.default.svc"
|
|
kubernetes_serviceaccount_dir: str = "/var/run/secrets/kubernetes.io/serviceaccount"
|
|
token_review_timeout_seconds: float = 5.0
|
|
|
|
|
|
settings = Settings()
|