Repository navigation
Bridge admitted scheduled slots to signed-run ports - #24
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Connect an already admitted scheduled delivery to the durable slot ledger and a trusted signed-run port. Persist started before the execution callback, preserve the actual success/failure/hold outcome, and commit the terminal receipt before publication. Redelivery after a lost publication acknowledgement retries publication only. A crash or signing failure leaves UNKNOWN and never authorizes another child execution.
The deterministic run identifier reversibly includes job, revision, host, manifest digest, agent, workflow and scheduled slot, so signed scope does not depend on an unsigned hash lookup. Full delivery scope and value types must match. The port remains responsible for real key/registration admission, durable signed records and governed export/read-back. This module supplies the sequencing bridge; it supplies no concrete signing adapter, daemon, schedule or activation. Exit code is local metadata, not an arbitrary payload bound by Shuttle v1 signatures.
Validation: 219 tests and 25 subtests pass, including duplicate delivery, publication failure, start/terminal failure, child exception, hold/failure distinction and scope mismatch. HOME guard: 157 paths/five resources unchanged. Ruff passes; wheel build and isolated installed-module imports pass.
Demo: recording, caption and reproduction uses a clearly labelled synthetic signing port and one child callback across two deliveries. Recording replayed. No real key, signature, child process or graph write is used. Rollback is a normal source revert while preserving any persistent slot ledger. No release/install/runtime action is requested by this source PR.
Bead: aegis-6vf
Overlap preflight: e9e0dcfe5ba54bb1cae8150e47d88d34eb689f98f93356b2d0762a996bf7b0e8