36 lines
2.6 KiB
JSON
36 lines
2.6 KiB
JSON
{
|
|
"task_id": "DEV-000152",
|
|
"task_revision": 1,
|
|
"architecture_revision": "ADR-0010",
|
|
"base_repo_revision": "624c41d4f6dae8c8d341aec09485efbba78bc76f",
|
|
"risk_tier": "E",
|
|
"intent": "Enable cognitive-worker to authenticate the local OpenAI-compatible CPU gateway through a typed file-backed credential reference without exposing provider key material in environment, source, or logs.",
|
|
"requirement_ids": ["AUDIT-WP-003", "AUDIT-WP-201", "CONSTITUTION-1.3.28"],
|
|
"allowed_change_scope": {
|
|
"modules": ["capability", "cognitive"],
|
|
"paths": [
|
|
"contracts/secrets/types.go",
|
|
"platform/secrets/**",
|
|
"adapters/models/openai_compatible_local.go",
|
|
"adapters/models/openai_compatible_local_test.go",
|
|
"cmd/cognitive-worker/main.go",
|
|
"cmd/cognitive-worker/main_test.go",
|
|
"dev/ACTIVE_TASK.json",
|
|
"dev/tasks/DEV-000152-cognitive-provider-secret-reference.json"
|
|
]
|
|
},
|
|
"forbidden_change_scope": {"paths": ["architecture/**", "security/**", "cmd/devctl/**", ".gitea/**", "deploy/**", "database/**"]},
|
|
"allowed_architecture_delta": {"new_cross_module_dependencies": 0, "new_canonical_owners": 0, "new_privileges": 0, "new_third_party_dependencies": 0, "new_database_owner_roles": 0},
|
|
"contracts": {"consume": ["typed CredentialRef", "protected file-backed secret resolver"], "may_change": ["secret purpose and trusted runtime consumer enum values"]},
|
|
"semantic_owner": "capability",
|
|
"canonical_state": ["provider credential material remains external to repository and database"],
|
|
"state_transitions": ["cognitive-worker sends a bearer credential only when a trusted file-backed reference resolves successfully"],
|
|
"side_effects_and_privileges": ["none; adapter receives resolved material from runtime bootstrap and never persists it"],
|
|
"persistence_and_migrations": ["no database migration"],
|
|
"failure_retry_restart": ["direct secret environment configuration fails closed", "missing reference or unreadable file fails startup", "no configured key preserves existing unauthenticated development behavior"],
|
|
"assumptions": ["production operators provision the gateway key into the protected secret volume separately; this task does not copy or reveal it"],
|
|
"acceptance_scenarios": ["resolved key becomes Authorization Bearer header", "no key sends no Authorization header", "direct environment secret is rejected", "secret value is absent from logs and repository"],
|
|
"required_tests": ["unit", "go test", "go vet", "architecture preflight", "check-diff", "git diff --check", "independent", "exact diff scope", "CI"],
|
|
"terminal_gap_states": ["BLOCKED_BY_MISSING_CAPABILITY", "BLOCKED_BY_CONFLICT", "BLOCKED_BY_ARCHITECTURE_GAP"]
|
|
}
|