103 lines
3.7 KiB
Markdown
103 lines
3.7 KiB
Markdown
# Task Admission Bootstrap P0 Runbook
|
|
|
|
## Goal
|
|
|
|
Repair the Task-admission bootstrap chain without enabling legacy/global writes.
|
|
|
|
## Preconditions
|
|
|
|
Re-read live authority, runtime mode, OpenAPI, capabilities and current Task
|
|
API. Do not assume the package source paths are current.
|
|
|
|
Required invariants:
|
|
|
|
```text
|
|
AIOS_GITOPS_WRITES_ENABLED=false
|
|
legacy_global_writes_enabled=false
|
|
18893=IMMUTABLE_STAGING
|
|
main/tag/baseline/production writes=false
|
|
```
|
|
|
|
## Semantic-port sequence
|
|
|
|
1. Locate the live Agent Task create/admission implementation.
|
|
2. Locate the current Owner/delegation signature verifier.
|
|
3. Port `aios_task_admission_bootstrap.py` as the common substrate.
|
|
4. Implement `TaskAdmissionPort.admit()` with the official Agent Task API.
|
|
5. Implement `OwnerAuthorizationBackend` with the current trusted verifier.
|
|
6. Wire the three task-admission operations into the existing Bridge.
|
|
7. Keep TaskPrincipal issuance downstream of real Task claim/TaskLease.
|
|
8. Merge the OpenAPI fragment only after the live handlers are wired.
|
|
9. Run impacted Linux/POSIX, TaskPrincipal, Bridge and writer regression.
|
|
10. Create the bootstrap-repair governed commit through the existing sanctioned
|
|
recovery path.
|
|
11. Use the repaired admission path to create the Repository Discovery P0 Task.
|
|
12. Claim/heartbeat -> TaskLease -> TaskPrincipal -> WriterLease.
|
|
13. Commit only the existing Repository Discovery allowlist through
|
|
`commitFilesGoverned`.
|
|
14. Reconcile ambiguous outcomes before any retry.
|
|
Admission uses a per-envelope, crash-releasing SQLite lock under the
|
|
admission state path's `.locks` directory. It persists the immutable
|
|
grant before an effect, then the official Task API GET reconciles any
|
|
crashed or ambiguous effect before a POST is permitted.
|
|
15. Replays revalidate the supplied proof, policy, expiry and revocation before
|
|
reading a receipt. A different otherwise-valid proof conflicts with the
|
|
persisted authorization digest; it never becomes a harmless receipt replay.
|
|
16. The Task API adapter must receive a server-resolved trusted execution plan
|
|
for the signed execution digest. It supplies `metadata.execution` with
|
|
the exact repository, branch, generation, digest and nonempty external job
|
|
identifier. Do not derive a job identity from request JSON or generate one.
|
|
17. Require Authority / remote Git / API OID equality and idempotent replay.
|
|
18. Publish immutable staging artifact and run Repository Discovery live E2E.
|
|
|
|
## Never do
|
|
|
|
- direct Task DB inserts/updates;
|
|
- direct bare-repo/ref changes;
|
|
- raw Git push as a substitute for governed publication;
|
|
- borrow SSH/Gitea/service credentials as Owner authorization;
|
|
- disable TaskPrincipal verification;
|
|
- issue TaskPrincipal without a live TaskLease;
|
|
- set global writes true;
|
|
- turn 18893 into a writer;
|
|
- include production/tag/baseline/main permissions in a task grant.
|
|
|
|
## Acceptance
|
|
|
|
Bootstrap repair:
|
|
|
|
```text
|
|
ENVELOPE_EXACT_REPLAY=PASS
|
|
SCOPE_NARROWING=PASS
|
|
DELEGATION_REVOKE_EXPIRY=PASS
|
|
OWNER_SIGNATURE_VERIFY=PASS
|
|
CONCURRENT_ADMISSION_SINGLE_TASK=PASS
|
|
TASK_DB_DIRECT_WRITE=false
|
|
TASKPRINCIPAL_BYPASS=false
|
|
GLOBAL_WRITES=false
|
|
CRASH_AFTER_EFFECT_REPLAY=PASS
|
|
CRASH_BEFORE_EFFECT_REPLAY=PASS
|
|
CHANGED_VALID_PROOF_CONFLICT=PASS
|
|
TASK_API_EXACT_IDENTITY=PASS
|
|
```
|
|
|
|
These are implementation and test acceptance conditions only. They are not
|
|
evidence of a live claim, governed publication, remote OID equality, or staging
|
|
E2E execution; obtain those independently through the sanctioned live runbook.
|
|
|
|
Repository Discovery publication:
|
|
|
|
```text
|
|
TASK_CREATED=PASS
|
|
TASK_CLAIMED=PASS
|
|
TASK_HEARTBEAT=PASS
|
|
TASK_LEASE=PASS
|
|
TASK_PRINCIPAL=PASS
|
|
WRITER_LEASE=PASS
|
|
COMMIT_FILES_GOVERNED=PASS
|
|
AUTHORITY_REMOTE_API_OID_EQUAL=PASS
|
|
IDEMPOTENCY_REPLAY=PASS
|
|
STAGING_LIVE_E2E=PASS
|
|
TASK_VERIFIED=SUCCEEDED
|
|
```
|