24 lines
2.7 KiB
JSON
24 lines
2.7 KiB
JSON
{
|
|
"task_id": "DEV-000194",
|
|
"task_revision": 1,
|
|
"architecture_revision": "ADR-0018",
|
|
"base_repo_revision": "c1db571a39514e65156123b7f9394645183cf2ab",
|
|
"risk_tier": "E",
|
|
"intent": "Move the explicit production Agent Execution dry-run canary from direct database secret environment input to protected file/CredentialRef storage and preserve durable lease/callback evidence.",
|
|
"requirement_ids": ["Agent Execution runtime and recovery", "protected canary configuration", "durable lease/callback canary"],
|
|
"allowed_change_scope": {"modules": ["agent-canary", "deployment"], "paths": ["cmd/agent-canary/main.go", "cmd/agent-canary/main_test.go", "deploy/docker-compose.prod.yml", "dev/ACTIVE_TASK.json", "dev/tasks/DEV-000194-agent-canary-protected-storage.json"]},
|
|
"forbidden_change_scope": {"paths": ["architecture/**", "security/**", "database/**", "modules/**", "contracts/**", ".gitea/**"]},
|
|
"allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 1, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
|
|
"contracts": {"consume": ["existing protected secret resolver", "existing ExecutionStore and dry-run canary contract"], "may_change": ["agent-canary runtime configuration"]},
|
|
"semantic_owner": "work-agent-execution",
|
|
"canonical_state": ["work.agent_dispatch_intents", "work.agent_leases", "work.agent_callback_heads"],
|
|
"state_transitions": ["explicit canary -> durable dispatch intent -> lease -> heartbeat callback -> result callback"],
|
|
"side_effects_and_privileges": ["manual opt-in dry-run only; protected database credential read; no external provider or source mutation"],
|
|
"persistence_and_migrations": ["none"],
|
|
"failure_retry_restart": ["missing/invalid protected secret fails before database open; direct secret env is rejected; canary remains explicit opt-in"],
|
|
"assumptions": ["the production compose secret volume already contains the work database credential reference used by agent-worker"],
|
|
"acceptance_scenarios": ["direct password environment is rejected", "path outside protected root is rejected", "compose renders canary with protected file/ref only", "production opt-in canary writes lease and callback evidence", "normal agent-worker remains recovery-only without an external bridge"],
|
|
"required_tests": ["go test ./...", "go vet ./...", "go run ./cmd/devctl preflight -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-diff -active dev/ACTIVE_TASK.json", "go run ./cmd/devctl check-architecture", "go run ./cmd/devctl independent", "git diff --check", "CI", "production canary and public health check"],
|
|
"terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_SPEC_GAP"]
|
|
}
|