From 5a8cd32aec87ab9682859bd2280a15b2a970f154 Mon Sep 17 00:00:00 2001 From: Paul O'Reilly Date: Tue, 8 Sep 2026 07:42:48 +1200 Subject: [PATCH] feat(harnesses): add customer-script/v1 composite Minimal harness for kind: customer_script nodes (agent-runtimes spec/tenant-namespaces.md SCR-1..SCR-6). No LLM turn - runs via the "shell" runner, agent-repo/v1 clone access only. Per-script credential needs are deliberately not baked into this base (SCR-6: narrow, per-script review) - compose a customer-script-/v1 variant layering whichever specific credential context a given script actually needs, rather than widening this shared base. Without this commit, kind: customer_script was not dispatchable from any machine other than the one it was authored on - the harness lookup against a fresh CRS sync would fail. Claude-Session: https://claude.ai/code/session_012arAwUuBQrpnMzJ36mEVBk --- .../composites/customer-script/v1/harness.yaml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 harnesses/composites/customer-script/v1/harness.yaml diff --git a/harnesses/composites/customer-script/v1/harness.yaml b/harnesses/composites/customer-script/v1/harness.yaml new file mode 100644 index 0000000..6a9ee20 --- /dev/null +++ b/harnesses/composites/customer-script/v1/harness.yaml @@ -0,0 +1,16 @@ +kind: composite +name: customer-script +version: 1 +description: >- + Minimal harness for customer-authored `kind: customer_script` nodes + (spec/tenant-namespaces.md SCR-1..SCR-6 in agent-runtimes). No LLM turn — + runs via the "shell" runner, agent-repo/v1 clone access only. Per-script + credential/secret needs are deliberately NOT baked into this base (SCR-6: + "an explicit, narrow allowlist... reviewed per script, not inherited + wholesale") — compose a `customer-script-/v1` variant layering + whichever specific git-credential context (e.g. gitea-ssh/v1, or a + read-only variant) and/or `secrets_required` account_ref entries a given + script actually needs, rather than widening this shared base. + +layers: + - context: agent-repo/v1