5a8cd32aec
Minimal harness for kind: customer_script nodes (agent-runtimes spec/tenant-namespaces.md SCR-1..SCR-6). No LLM turn - runs via the "shell" runner, agent-repo/v1 clone access only. Per-script credential needs are deliberately not baked into this base (SCR-6: narrow, per-script review) - compose a customer-script-<need>/v1 variant layering whichever specific credential context a given script actually needs, rather than widening this shared base. Without this commit, kind: customer_script was not dispatchable from any machine other than the one it was authored on - the harness lookup against a fresh CRS sync would fail. Claude-Session: https://claude.ai/code/session_012arAwUuBQrpnMzJ36mEVBk
17 lines
752 B
YAML
17 lines
752 B
YAML
kind: composite
|
|
name: customer-script
|
|
version: 1
|
|
description: >-
|
|
Minimal harness for customer-authored `kind: customer_script` nodes
|
|
(spec/tenant-namespaces.md SCR-1..SCR-6 in agent-runtimes). No LLM turn —
|
|
runs via the "shell" runner, agent-repo/v1 clone access only. Per-script
|
|
credential/secret needs are deliberately NOT baked into this base (SCR-6:
|
|
"an explicit, narrow allowlist... reviewed per script, not inherited
|
|
wholesale") — compose a `customer-script-<need>/v1` variant layering
|
|
whichever specific git-credential context (e.g. gitea-ssh/v1, or a
|
|
read-only variant) and/or `secrets_required` account_ref entries a given
|
|
script actually needs, rather than widening this shared base.
|
|
|
|
layers:
|
|
- context: agent-repo/v1
|