marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

spec(ai-service-plane): start signal through the router; credentials only in the start request

Browse Source 
The live cluster ran the task command twice: in the actor and in Substrate's
golden-snapshot boot, which gets the same image and task env. Requirement 4.5
gates the command on a router-addressed start request; 4.6 carries provider
credentials only in that request.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo
This commit is contained in:
Marius Ciepluch
2026-09-29 19:19:11 +02:00
co-authored by Claude Opus 5.5
parent 2e7e0550b2
commit ac296ee3a4
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.kiro/specs/ai-service-plane/requirements.md
+7
View File
@@ -98,6 +98,13 @@ later.
4. Because ax has no artifact channel, the runner delivers the task's output directory (including
`summary.json` and `units.jsonl`) to the reconciler's artifact endpoint named in `OUSAST_ARTIFACT_URL`
before it reports completion; a delivery failure is reported as `failed`, never as done.
5. The command never runs in Agent Substrate's golden-snapshot boot, which executes the same image with the same
task environment (observed on the live cluster, 2026-09-29): the runner prepares workspaces, reports ready and
waits; the reconciler starts the command with one request to the task's actor through Substrate's router
(`ate-target-actor: <atespace>/<task>`), which never addresses the golden actor. A second start request for
the same task is refused.
6. Provider credentials reach a task only in that start request, held in the runner's memory and passed to the
command's environment; they never appear in a manifest, a rendered Task, an ax template or any file.
### Requirement 5: `repo-facts` is the memory layer