skynet/agent-runtime-framework
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: STATE_TX_FROM_STATES on state-tx nodes; workflow-script composite invariant; refresh legacy-mount NOTE

Browse Source 
Claude-Session: https://claude.ai/code/session_01N218bERyNeLhbLmDRDvbWF
This commit is contained in:
Paul O'Reilly
2026-10-01 17:02:29 +13:00
parent 9e2dd681a7
commit 782eadb615
5 changed files with 92 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
task-templates/workflow/bug-ancestor-auto-advance@1.yaml
View File

@@ -57,15 +57,22 @@ nodes:
runtime_env:
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
STATE_TX_NEW_STATE: verify-pending
# NOTE (script-node credentials, M43): kind: script nodes are harness-exempt
# (WF-COMP-6) but now carry the AU-51 internal-service bearer token by
# default — see spec/typed-workflows.md WF-COMP-26. The compiler emits
# `secrets_required: [CP_SERVICE_TOKEN]` and
# `runtime_env.CP_SERVICE_TOKEN_FILE=/run/secrets/CP_SERVICE_TOKEN` on
# every script node; the dispatcher's `_run_script_task` legacy-key
# branch mounts the dispatcher-process-env CP_SERVICE_TOKEN value as a
# file. All three nodes above read it via
# `open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()`. Each script
# still resolves its own actor identity (OIDC_IDENTITY_EMAIL or
STATE_TX_FROM_STATES: "pending,open"
# NOTE (script-node credentials): kind: script nodes are harness-exempt
# (WF-COMP-6), but the flag-on script path composes the workflow-script/v1
# composite (shared-variables/v1 + cp-service-token/v1; WF-COMP-31). The
# cp-service-token/v1 layer restages the AU-51 internal-service bearer token
# and exports CP_SERVICE_TOKEN_FILE=/run/agent/cp-service-token/token, which
# all three nodes above read via
# `open(os.environ["CP_SERVICE_TOKEN_FILE"]).read().strip()`. The legacy
# WF-COMP-26 mount (`secrets_required: [CP_SERVICE_TOKEN]` and
# `runtime_env.CP_SERVICE_TOKEN_FILE=/run/secrets/CP_SERVICE_TOKEN`, backed by
# the dispatcher's legacy-key branch) is removed (WF-COMP-33 step 10). Each
# script still resolves its own actor identity (OIDC_IDENTITY_EMAIL or
# CP_Caller-Identity header — see scripts/workflow/tag-set and
# parent-link-check) for the write envelope.
#
# STATE_TX_FROM_STATES on the state-tx node is the compare-and-set guard: the
# live flow_state must be one of the listed states (or already the target),
# else state-tx exits 2 (unexpected_current_state). pending,open mirror
# `input.state` + `escalation_input_states`.

1
task-templates/workflow/frozen-fixture-emit@1.yaml
View File

@@ -24,3 +24,4 @@ nodes:
runtime_env:
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
STATE_TX_NEW_STATE: test-skeleton-ready
STATE_TX_FROM_STATES: scoped-tagged

1
task-templates/workflow/test-validate@1.yaml
View File

@@ -32,3 +32,4 @@ nodes:
runtime_env:
CP_URL: "http://controlplane.agent-runtimes.svc.cluster.local:8100"
STATE_TX_NEW_STATE: test-validated
STATE_TX_FROM_STATES: test-write-pending