skynet/agent-runtime-framework
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(harnesses): shared-variables/v1 context + workflow-script/v1 composite (WF-COMP-31, WV-19) (03878b12-86b5-4b88-86d5-7182ae1c471f)

Browse Source
This commit is contained in:
Paul O'Reilly
2026-10-01 15:31:48 +13:00
parent da23760e93
commit b549a28187
4 changed files with 419 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
harnesses/composites/workflow-script/v1/harness.yaml Normal file
View File

@@ -0,0 +1,24 @@
kind: composite
name: workflow-script
version: 1
description: "Internal composite for the flag-on kind: script path (typed-workflows WF-COMP-31 / workflow-variables WV-19). Brings the shared-variables filesystem context AND the AU-51 CP write credential (cp-service-token/v1 sets CP_SERVICE_TOKEN_FILE in the entrypoint process env before shell_runner runs). NOT a model-bearing composite — the kind: script compiled shape is cli=\"shell\", params.cmd=<cmd>; this composite provides the harness layers that path needs and nothing else."
# Order matters only for HC-6 env last-writer-wins / HC-8 git identity. The two
# layers here have disjoint env vars (shared-variables sets WORKFLOW_VARIABLES_*
# paths, cp-service-token sets CP_SERVICE_TOKEN_FILE) and no overlapping git
# identity, so the listed order has no observable merge effect — both layers
# reach the script-node container either way.
layers:
# spec/workflow-variables.md WV-19 / spec/harness.md HD-14 — agent-facing
# /variables/ context (CLAUDE.md mounted at /opt/harness/context/shared-variables/CLAUDE.md)
# plus WORKFLOW_VARIABLES_ROOT=/variables and templated WORKFLOW_VARIABLES_SELF=<step_path>.
# Provides the [shared-variables] tag used by the dispatcher's extra_layers injection.
- context: shared-variables/v1
# spec/typed-workflows.md WF-COMP-31 "AU-51 credential env seam" — this layer's
# init.sh restages the ESO-mounted CP-service-token secret (root-owned mode 0400)
# to an agent-owned 0600 copy at /run/agent/cp-service-token/token and exports
# CP_SERVICE_TOKEN_FILE pointing at it. Verified: env.CP_SERVICE_TOKEN_FILE is set
# on the entrypoint process environment before shell_runner runs (entrypoint reads
# os.environ via env=os.environ.copy() in subprocess.run at entrypoint/runners/shell.py:73,
# so the same credential channel an agent node gets reaches a script node unchanged).
- context: cp-service-token/v1