38cd0b040b
New context mounts the cp-decompose-service-token account (system
provider type, account_id 1d963673-6ac9-4f85-875a-2ce5323e76ad, owner
(cp, cp)) via ESO and exports CP_SERVICE_TOKEN_FILE pointing at the
mounted secret file. Wired into spec-writing-sonnet-repo (backs
scope-decompose-sonnet@1, which calls back POST
/v1/work-items/{id}/decompose — bug b3a96acc / fa41caac / M42 stall).
The mounted value must match the CP's CP_INTERNAL_BEARER_TOKEN
(agent-runtimes deploy repo, overlays/{production,staging}/app-secret.sops.yaml).
No init.sh needed — the mount path is static at harness-authoring time
and entrypoint/actions/decompose_work_items.py (AU-51b, agent-runtimes
commit 0fa8b760) reads CP_SERVICE_TOKEN_FILE directly, so no
transformation/staging step is required.
14 lines
437 B
YAML
14 lines
437 B
YAML
kind: composite
|
|
name: spec-writing-sonnet-repo
|
|
version: 1
|
|
description: "Spec writing agent with Sonnet + repo clone via SSH"
|
|
|
|
layers:
|
|
- context: spec-writing/v1
|
|
- context: anthropic-cloud-paul-oauth/v1
|
|
- context: gitea-ssh/v1
|
|
- context: agent-repo/v1
|
|
# AU-51/AU-51b: this composite backs scope-decompose-sonnet@1, which
|
|
# calls back POST /v1/work-items/{id}/decompose — needs a credential.
|
|
- context: cp-service-token/v1
|