CP2A2.2B: L1 Red Queen Worker Foundation - separate minimal worker runtime (non-root, read-only rootfs, cap-drop ALL, no-new-privileges, internal-net, credential-zero, inert idle, NO autonomy/heartbeat/scheduler)
This commit is contained in:
root
parent
7b58d27fa0
commit
7a4220d86d
11 changed files with 824 additions and 0 deletions
46
red-queen-architecture/control-plane/cp2a2_2b/Dockerfile
Normal file
46
red-queen-architecture/control-plane/cp2a2_2b/Dockerfile
Normal file
|
|
@ -0,0 +1,46 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker (L1 Worker Foundation)
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE. NO AUTONOMY. NO HEARTBEAT. NO SCHEDULER.
|
||||||
|
#
|
||||||
|
# Separate minimale L1 Worker Runtime fuer spaetere Read-only-Autonomie.
|
||||||
|
# Basis: nousresearch/hermes-agent:latest (Hermes oneshot `hermes -z`).
|
||||||
|
#
|
||||||
|
# HAERTUNG:
|
||||||
|
# - non-root hermes-User (UID 10010 / GID 10000, im Basis-Image definiert)
|
||||||
|
# - read-only rootfs (docker-compose: read_only: true)
|
||||||
|
# - cap_drop ALL, no-new-privileges (docker-compose)
|
||||||
|
# - kein Docker-Socket, keine Host-Root-Mounts, keine Host-Namespaces
|
||||||
|
# - kein s6-overlay / kein Gateway / kein Telegram / kein API-Server
|
||||||
|
# - eigener minimaler Entrypoint (inert idle, KEIN autonomer Loop)
|
||||||
|
#
|
||||||
|
# CREDENTIAL ZERO POLICY: Dieses Image enthaelt KEINE Credentials.
|
||||||
|
# Kein FORGEJO_WRITE_TOKEN, NOTION_API_KEY, TELEGRAM_BOT_TOKEN,
|
||||||
|
# SAVE_TOKEN, DELETE_TOKEN, SSH-Keys, Git-Write-Credentials, .netrc,
|
||||||
|
# .git-credentials, Cloud/DB/Service-Account/Webhook/Bearer/Docker/
|
||||||
|
# Broker/Trading-Credentials. ENV wird im Compose NICHT gesetzt.
|
||||||
|
#
|
||||||
|
# RED_QUEEN_TRADING_AUTHORITY=NEVER (permanente Invariante, siehe CP1.0S).
|
||||||
|
|
||||||
|
FROM nousresearch/hermes-agent:latest
|
||||||
|
|
||||||
|
# Kein s6-overlay, kein Gateway. Eigener minimaler Entrypoint.
|
||||||
|
# Der Worker startet inert (sleep infinity) und fuehrt KEINEN autonomen Tick aus.
|
||||||
|
# Ein Tick wird ausschliesslich extern getriggert (spaeterer externer Scheduler
|
||||||
|
# -> Gate-Evaluator /check -> ALLOW -> `hermes -z` oneshot). In CP2A2.2B existiert
|
||||||
|
# der Tick-Wrapper als Datei, wird aber NICHT automatisch ausgefuehrt.
|
||||||
|
|
||||||
|
# Worker-eigene Skripte (read-only im Image, keine Secrets)
|
||||||
|
COPY worker-entrypoint.sh /opt/l1-worker/worker-entrypoint.sh
|
||||||
|
COPY worker-tick.sh /opt/l1-worker/worker-tick.sh
|
||||||
|
COPY worker-config.yaml /opt/l1-worker/worker-config.yaml
|
||||||
|
|
||||||
|
# State-Verzeichnis (worker-owned, wird als Volume gemountet)
|
||||||
|
# Der hermes-User (UID 10010) ist der Worker. Das State-Volume wird im
|
||||||
|
# Compose als bind-mount von /opt/l1-worker-state gemountet (Host-root-angelegt,
|
||||||
|
# auf 10010:10000 gechownt) — nur der Worker kann schreiben.
|
||||||
|
RUN mkdir -p /opt/l1-worker/state && chown -R hermes:hermes /opt/l1-worker
|
||||||
|
|
||||||
|
# Non-root: der Worker laeuft als hermes-User (UID 10010 / GID 10000).
|
||||||
|
USER hermes:hermes
|
||||||
|
|
||||||
|
# Inert idle Entrypoint: KEIN autonomer Loop, KEIN Tick-Start.
|
||||||
|
ENTRYPOINT ["/bin/sh", "/opt/l1-worker/worker-entrypoint.sh"]
|
||||||
94
red-queen-architecture/control-plane/cp2a2_2b/ROLLBACK.md
Normal file
94
red-queen-architecture/control-plane/cp2a2_2b/ROLLBACK.md
Normal file
|
|
@ -0,0 +1,94 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Rollback-Dokumentation
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
|
||||||
|
## Zweck
|
||||||
|
|
||||||
|
Rollback muss den L1 Worker vollstaendig entfernen/deaktivieren koennen, OHNE:
|
||||||
|
- CP1 State zu loeschen
|
||||||
|
- CP1 Audit zu loeschen
|
||||||
|
- Gate Evaluator zu veraendern
|
||||||
|
- interactive RQ zu veraendern
|
||||||
|
- AUTH4C/4D zu veraendern
|
||||||
|
- Trading zu veraendern
|
||||||
|
|
||||||
|
Worker-internal State bei Rollback zunaechst PRESERVE, nicht blind loeschen.
|
||||||
|
|
||||||
|
## Rollback-Schritte
|
||||||
|
|
||||||
|
### 1. Worker-Container stoppen und entfernen
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /opt/cp2a2_2b
|
||||||
|
docker compose -f docker-compose.yml down
|
||||||
|
```
|
||||||
|
|
||||||
|
Dies stoppt und entfernt den `l1-red-queen-worker` Container und das
|
||||||
|
`l1-internal` Netzwerk. Das Worker-State-Volume `l1-worker-state` bleibt
|
||||||
|
erhalten (PRESERVE).
|
||||||
|
|
||||||
|
### 2. Netzwerk-Attachments entfernen (falls angehaengt)
|
||||||
|
|
||||||
|
Falls Gate-Evaluator, Ollama oder Tolaria an das `l1-internal` Netz angehaengt
|
||||||
|
wurden, werden diese Attachments entfernt:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker network disconnect l1-internal gate-evaluator 2>/dev/null || true
|
||||||
|
docker network disconnect l1-internal ollama-nb6d-ollama-1 2>/dev/null || true
|
||||||
|
docker network disconnect l1-internal tolaria 2>/dev/null || true
|
||||||
|
```
|
||||||
|
|
||||||
|
Hinweis: `docker compose down` entfernt das `l1-internal` Netzwerk automatisch,
|
||||||
|
wodurch alle Attachments ebenfalls entfernt werden.
|
||||||
|
|
||||||
|
### 3. Worker-State-Volume (PRESERVE)
|
||||||
|
|
||||||
|
Das Worker-State-Volume `l1-worker-state` wird beim Rollback NICHT geloescht.
|
||||||
|
Es bleibt fuer spaetere Re-Initialisierung erhalten.
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Volume-Liste pruefen (nicht loeschen)
|
||||||
|
docker volume ls | grep l1-worker-state
|
||||||
|
```
|
||||||
|
|
||||||
|
### 4. Image entfernen (optional)
|
||||||
|
|
||||||
|
```bash
|
||||||
|
docker rmi l1-red-queen-worker:cp2a2_2b
|
||||||
|
```
|
||||||
|
|
||||||
|
### 5. SoT-Ruecknahme (optional)
|
||||||
|
|
||||||
|
Falls der SoT-Commit zurueckgenommen werden soll:
|
||||||
|
|
||||||
|
```bash
|
||||||
|
cd /opt/cp11_checker
|
||||||
|
git revert <commit-sha>
|
||||||
|
git push origin main
|
||||||
|
```
|
||||||
|
|
||||||
|
Hinweis: Der SoT-Commit ist historisch. Ein Revert erstellt einen neuen Commit,
|
||||||
|
der die Aenderungen zuruecknimmt. Der urspruengliche Commit bleibt im Log.
|
||||||
|
|
||||||
|
## Was beim Rollback NICHT veraendert wird
|
||||||
|
|
||||||
|
- CP1 State (`/opt/control-plane/state/`) — unveraendert
|
||||||
|
- CP1 Audit (`/opt/control-plane/audit/`) — unveraendert
|
||||||
|
- Gate Evaluator (`gate-evaluator` Container) — unveraendert
|
||||||
|
- Interactive RQ (`hermes-red-queen` Container) — unveraendert
|
||||||
|
- AUTH4C/4D — unveraendert
|
||||||
|
- Trading-System — unveraendert
|
||||||
|
|
||||||
|
## Verifikation nach Rollback
|
||||||
|
|
||||||
|
```bash
|
||||||
|
# Worker-Container entfernt
|
||||||
|
docker ps -a | grep l1-red-queen-worker || echo "Worker entfernt"
|
||||||
|
|
||||||
|
# Interactive RQ unveraendert
|
||||||
|
docker inspect hermes-red-queen --format '{{.State.Status}} {{.State.StartedAt}}'
|
||||||
|
|
||||||
|
# Gate Evaluator unveraendert
|
||||||
|
docker ps | grep gate-evaluator
|
||||||
|
|
||||||
|
# CP1 State unveraendert
|
||||||
|
ls -la /opt/control-plane/state/
|
||||||
145
red-queen-architecture/control-plane/cp2a2_2b/SECURITY.md
Normal file
145
red-queen-architecture/control-plane/cp2a2_2b/SECURITY.md
Normal file
|
|
@ -0,0 +1,145 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Security-Dokumentation
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE. NO AUTONOMY. NO HEARTBEAT. NO SCHEDULER.
|
||||||
|
|
||||||
|
## 1. Zweck
|
||||||
|
|
||||||
|
Separate minimale L1 Worker Runtime (`l1-red-queen-worker`) als technische
|
||||||
|
Sandbox/Foundation fuer spaetere Read-only-Autonomie. In CP2A2.2B:
|
||||||
|
- KEINE Autonomie
|
||||||
|
- KEINE Mission Execution
|
||||||
|
- KEIN Heartbeat
|
||||||
|
- KEIN Scheduler
|
||||||
|
- KEIN autonomer Tick
|
||||||
|
|
||||||
|
Der bestehende interaktive Container `hermes-red-queen` bleibt UNVERAENDERT.
|
||||||
|
|
||||||
|
## 2. Security-Invarianten (permanent)
|
||||||
|
|
||||||
|
RED_QUEEN_TRADING_AUTHORITY=NEVER
|
||||||
|
|
||||||
|
Der L1 Worker darf niemals erhalten:
|
||||||
|
- Broker Credentials
|
||||||
|
- Broker APIs
|
||||||
|
- Trading Tokens
|
||||||
|
- Trading Execution Authority
|
||||||
|
- Trading Kill-Switch Authority
|
||||||
|
|
||||||
|
Trading ist eine separate Security Domain.
|
||||||
|
|
||||||
|
Zusaetzlich:
|
||||||
|
- MISSION != AUTHORIZATION
|
||||||
|
- COMMAND != AUTHORIZATION
|
||||||
|
- RQ_DECISION != AUTHORIZATION
|
||||||
|
- GATE_CHECK != CAPABILITY_GRANT
|
||||||
|
|
||||||
|
## 3. Credential Zero Policy
|
||||||
|
|
||||||
|
Im L1 Worker sind ABSENT:
|
||||||
|
- FORGEJO_WRITE_TOKEN, NOTION_API_KEY, TELEGRAM_BOT_TOKEN
|
||||||
|
- SAVE_TOKEN, DELETE_TOKEN
|
||||||
|
- SSH private keys, Git write credentials, .netrc, .git-credentials
|
||||||
|
- credential helpers mit Secrets
|
||||||
|
- Cloud Credentials, DB Credentials (produktive externe DBs)
|
||||||
|
- Service Account Credentials, Webhook Secrets, Generic Bearer Tokens
|
||||||
|
- Docker Credentials, Broker Credentials, Trading Credentials
|
||||||
|
|
||||||
|
Geprueft werden: ENV files, mounted secrets, process environment, config,
|
||||||
|
home directory, git config, credential helpers.
|
||||||
|
|
||||||
|
Report: NUR PRESENT/ABSENT. NIEMALS Secret-Werte ausgeben.
|
||||||
|
|
||||||
|
## 4. Container-Hardening
|
||||||
|
|
||||||
|
- non-root UID/GID: hermes-User (UID 10010 / GID 10000)
|
||||||
|
- read-only rootfs
|
||||||
|
- cap_drop ALL
|
||||||
|
- no-new-privileges
|
||||||
|
- kein privileged
|
||||||
|
- kein Docker-Socket
|
||||||
|
- keine Host-Root-Mounts
|
||||||
|
- keine Host-Namespaces
|
||||||
|
- keine Device-Mounts
|
||||||
|
- keine unnecessary Linux capabilities
|
||||||
|
|
||||||
|
Writable nur: worker-owned internal state volume + technisch zwingende tmpfs-Pfade.
|
||||||
|
|
||||||
|
## 5. Tool-Capability-Model
|
||||||
|
|
||||||
|
Der Worker darf NICHT haben:
|
||||||
|
- terminal, generic shell, execute_code
|
||||||
|
- write_file auf externe/shared Ziele, patch
|
||||||
|
- git push, SSH, Docker, cronjob, send_message, delegation
|
||||||
|
- arbitrary command execution
|
||||||
|
|
||||||
|
MAX_SUBAGENTS=0. Nur minimal erforderliche Read-only-Faehigkeiten.
|
||||||
|
|
||||||
|
Ground-Truth-Verifikation: prueft die tatsaechlich geladenen Toolsets,
|
||||||
|
nicht nur die Config.
|
||||||
|
|
||||||
|
## 6. Network-Model
|
||||||
|
|
||||||
|
KEIN allgemeiner Internet-Egress. Worker erreicht nur:
|
||||||
|
- A. Gate Evaluator (internal)
|
||||||
|
- B. Ollama (internal)
|
||||||
|
- C. Tolaria READ/Search (internal)
|
||||||
|
|
||||||
|
NICHT erreichbar:
|
||||||
|
- Telegram API, Notion API, Forgejo public Host
|
||||||
|
- Internet allgemein, Trading Networks, Broker endpoints
|
||||||
|
- Docker API, Host management interfaces
|
||||||
|
- SAVE executor, DELETE executor
|
||||||
|
|
||||||
|
Keine generische Proxy-/Relay-Loesung.
|
||||||
|
|
||||||
|
## 7. Gate Evaluator
|
||||||
|
|
||||||
|
Worker darf den bestehenden Gate Evaluator erreichen. CP1 bleibt unveraendert.
|
||||||
|
Aktuell: GLOBAL_AUTONOMY=OFF, PRODUCTIVE_MUTATIONS=OFF, SAVE=OFF, DELETE=OFF,
|
||||||
|
EMERGENCY_STOP=ON. Daher muss jeder produktive AUTONOMOUS_TICK_START weiterhin
|
||||||
|
DENY ergeben. KEIN State aendern, um ALLOW zu testen.
|
||||||
|
|
||||||
|
## 8. Tolaria
|
||||||
|
|
||||||
|
Nur READ/Search. Worker darf KEINEN Tolaria SAVE/DELETE Token erhalten.
|
||||||
|
NICHT produktiv schreiben. Keine Mutation als Test.
|
||||||
|
|
||||||
|
## 9. Ollama / LLM
|
||||||
|
|
||||||
|
Worker darf Ollama erreichen (fuer Hermes-Start erforderlich). Keine
|
||||||
|
Credentials noetig. Keine dadurch entstehende externe Mutation Capability.
|
||||||
|
KEINE autonome Mission ausfuehren.
|
||||||
|
|
||||||
|
## 10. Internal State Volume
|
||||||
|
|
||||||
|
Worker-eigenes persistentes State-Volume. Noch KEINE produktive A2-A5
|
||||||
|
Initialisierung. Erlaubt: leeres/verifiziertes State-Verzeichnis bzw.
|
||||||
|
Foundation-Struktur. Noch NICHT: missions.db produktiv initialisieren,
|
||||||
|
safety runtime starten, orchestration runtime starten, heartbeat starten,
|
||||||
|
tick loop starten. Worker State darf ausschliesslich vom Worker beschrieben
|
||||||
|
werden. Bestehende interaktive RQ darf dieses Volume NICHT schreiben.
|
||||||
|
|
||||||
|
## 11. Mission Transfer — NOT YET
|
||||||
|
|
||||||
|
In CP2A2.2B: KEIN Shared Mission Volume, KEINE Mission Queue, KEIN Mission
|
||||||
|
Broker, KEIN Mission Snapshot produktiv anbinden. Mission Transfer kommt
|
||||||
|
separat danach.
|
||||||
|
|
||||||
|
## 12. No Autostart Autonomy
|
||||||
|
|
||||||
|
Nach Host-Reboot, Docker-Reboot, Container-Restart, Compose-up darf NICHT
|
||||||
|
automatisch ein autonomer Tick beginnen. Worker Foundation darf existieren/
|
||||||
|
starten, aber autonome Mission Execution bleibt unmoeglich. Gate DENY allein
|
||||||
|
ist nicht die einzige Schutzschicht. Es darf noch gar kein autonomer
|
||||||
|
Scheduler/Loop existieren.
|
||||||
|
|
||||||
|
## 13. Resource Limits
|
||||||
|
|
||||||
|
Konservative Foundation-Limits (siehe docker-compose / deploy):
|
||||||
|
- CPU limit
|
||||||
|
- memory limit
|
||||||
|
- pids limit
|
||||||
|
- bounded tmpfs
|
||||||
|
- log rotation
|
||||||
|
|
||||||
|
Ein fehlerhafter Worker darf den Host nicht durch Ressourcenverbrauch
|
||||||
|
beeintraechtigen.
|
||||||
44
red-queen-architecture/control-plane/cp2a2_2b/deploy.sh
Normal file
44
red-queen-architecture/control-plane/cp2a2_2b/deploy.sh
Normal file
|
|
@ -0,0 +1,44 @@
|
||||||
|
#!/bin/bash
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Deploy-Skript
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE. NO AUTONOMY. NO HEARTBEAT. NO SCHEDULER.
|
||||||
|
#
|
||||||
|
# Baut und startet den L1 Worker Container (non-root, hardened, internal-Netz).
|
||||||
|
# Haengt Gate-Evaluator, Ollama und Tolaria an das l1-internal Netz an
|
||||||
|
# (nur Netzwerk-Attachment, KEINE Config/ENV/Credential-Aenderung).
|
||||||
|
#
|
||||||
|
# KEIN AUTOSTART-AUTONOMIE: Der Container startet inert (sleep infinity).
|
||||||
|
# Kein autonomer Tick, kein Heartbeat, kein Scheduler.
|
||||||
|
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
cd "$(dirname "$0")"
|
||||||
|
|
||||||
|
echo "=== CP2A2.2B L1 WORKER DEPLOY ==="
|
||||||
|
|
||||||
|
# 1. Worker-State-Volume vorbereiten (worker-owned, UID 10010)
|
||||||
|
# Das Volume wird als named volume gemountet; der hermes-User (UID 10010)
|
||||||
|
# ist der Worker und besitzt das State-Verzeichnis.
|
||||||
|
echo "[1/4] Worker-State-Volume vorbereiten..."
|
||||||
|
docker volume create l1-worker-state >/dev/null 2>&1 || true
|
||||||
|
|
||||||
|
# 2. Image bauen (aus SoT, non-root, read-only, cap-drop)
|
||||||
|
echo "[2/4] Image bauen (l1-red-queen-worker:cp2a2_2b)..."
|
||||||
|
docker build -t l1-red-queen-worker:cp2a2_2b .
|
||||||
|
|
||||||
|
# 3. Container starten (internal-Netz, non-root, hardened)
|
||||||
|
echo "[3/4] Container starten (l1-red-queen-worker)..."
|
||||||
|
docker compose -f docker-compose.yml up -d
|
||||||
|
|
||||||
|
# 4. Interne Ziele an l1-internal Netz anhaengen (nur Netzwerk-Attachment)
|
||||||
|
echo "[4/4] Interne Ziele an l1-internal Netz anhaengen..."
|
||||||
|
docker network connect l1-internal gate-evaluator 2>/dev/null || echo " (gate-evaluator bereits verbunden oder nicht verfuegbar)"
|
||||||
|
docker network connect l1-internal ollama-nb6d-ollama-1 2>/dev/null || echo " (ollama bereits verbunden oder nicht verfuegbar)"
|
||||||
|
docker network connect l1-internal tolaria 2>/dev/null || echo " (tolaria bereits verbunden oder nicht verfuegbar)"
|
||||||
|
|
||||||
|
echo ""
|
||||||
|
echo "=== DEPLOY ABGESCHLOSSEN ==="
|
||||||
|
echo "Container: l1-red-queen-worker (inert idle, NO AUTONOMY)"
|
||||||
|
echo "Netzwerk: l1-internal (internal=true, keine Egress)"
|
||||||
|
echo "State-Volume: l1-worker-state (worker-owned)"
|
||||||
|
echo ""
|
||||||
|
echo "Hinweis: Der Worker startet inert. Kein autonomer Tick wird gestartet."
|
||||||
|
|
@ -0,0 +1,57 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: docker-compose
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE. NO AUTONOMY. NO HEARTBEAT. NO SCHEDULER.
|
||||||
|
#
|
||||||
|
# Separate minimale L1 Worker Runtime. Der bestehende interaktive Container
|
||||||
|
# `hermes-red-queen` bleibt UNVERAENDERT (wird hier NICHT referenziert).
|
||||||
|
#
|
||||||
|
# HAERTUNG:
|
||||||
|
# - non-root hermes-User (UID 10010 / GID 10000, im Basis-Image definiert)
|
||||||
|
# - read-only rootfs
|
||||||
|
# - cap_drop ALL, no-new-privileges
|
||||||
|
# - kein Docker-Socket, keine Host-Root-Mounts, keine Host-Namespaces
|
||||||
|
# - eigenes internal-Netz (keine Egress, kein Internet)
|
||||||
|
# - KEINE Credentials in ENV (Credential Zero Policy)
|
||||||
|
#
|
||||||
|
# NETZWERK-MODELL:
|
||||||
|
# Der Worker haengt an einem eigenen internal-Netz `l1-internal`.
|
||||||
|
# Gate-Evaluator, Ollama und Tolaria werden per `docker network connect`
|
||||||
|
# zusaetzlich an dieses Netz angehaengt (nur Netzwerk-Attachment, KEINE
|
||||||
|
# Config/ENV/Credential-Aenderung an diesen Containern).
|
||||||
|
# Kein genereller Internet-Egress, kein Telegram/Notion/Forgejo-public.
|
||||||
|
#
|
||||||
|
# KEIN AUTOSTART-AUTONOMIE:
|
||||||
|
# Der Container startet inert (sleep infinity). Kein autonomer Tick, kein
|
||||||
|
# Heartbeat, kein Scheduler. Ein Tick wird ausschliesslich extern getriggert
|
||||||
|
# (spaetere Phase) und ist in CP2A2.2B verboten.
|
||||||
|
|
||||||
|
services:
|
||||||
|
l1-red-queen-worker:
|
||||||
|
build: .
|
||||||
|
image: l1-red-queen-worker:cp2a2_2b
|
||||||
|
container_name: l1-red-queen-worker
|
||||||
|
restart: unless-stopped
|
||||||
|
read_only: true
|
||||||
|
cap_drop:
|
||||||
|
- ALL
|
||||||
|
security_opt:
|
||||||
|
- no-new-privileges:true
|
||||||
|
tmpfs:
|
||||||
|
- /tmp
|
||||||
|
volumes:
|
||||||
|
# Worker-eigenes persistentes State-Volume (worker-owned, UID 10010).
|
||||||
|
# Nur der Worker kann schreiben. Bestehende interaktive RQ darf dieses
|
||||||
|
# Volume NICHT schreiben (separate Security Domain).
|
||||||
|
- l1-worker-state:/opt/l1-worker/state
|
||||||
|
networks:
|
||||||
|
- l1-internal
|
||||||
|
environment: []
|
||||||
|
# KEINE Credentials. KEIN Docker-Socket. KEINE Host-Root-Mounts.
|
||||||
|
# KEIN Gateway, KEIN Telegram, KEIN API-Server, KEIN Cron.
|
||||||
|
|
||||||
|
networks:
|
||||||
|
l1-internal:
|
||||||
|
driver: bridge
|
||||||
|
internal: true
|
||||||
|
|
||||||
|
volumes:
|
||||||
|
l1-worker-state:
|
||||||
|
|
@ -0,0 +1,157 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Credential-Zero-Test
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Verifiziert, dass der Worker KEINE mutierenden Credentials besitzt.
|
||||||
|
# Report NUR PRESENT/ABSENT — NIEMALS Secret-Werte ausgeben.
|
||||||
|
#
|
||||||
|
# Geprueft werden:
|
||||||
|
# - ENV-Variablen (mutierende Credential-Namen)
|
||||||
|
# - config.yaml (worker-config.yaml)
|
||||||
|
# - Home-Verzeichnis (keine .netrc, .git-credentials, SSH-Keys)
|
||||||
|
# - git config (keine credential helpers)
|
||||||
|
# - mounted secrets
|
||||||
|
|
||||||
|
import os
|
||||||
|
import re
|
||||||
|
import sys
|
||||||
|
import subprocess
|
||||||
|
|
||||||
|
# Mutierende Credential-Namen (nur Namen, keine Werte)
|
||||||
|
MUTATING_CREDENTIAL_NAMES = [
|
||||||
|
"FORGEJO_WRITE_TOKEN",
|
||||||
|
"NOTION_API_KEY",
|
||||||
|
"TELEGRAM_BOT_TOKEN",
|
||||||
|
"SAVE_TOKEN",
|
||||||
|
"DELETE_TOKEN",
|
||||||
|
"TOLARIA_SAVE_TOKEN",
|
||||||
|
"TOLARIA_DELETE_TOKEN",
|
||||||
|
"GITHUB_TOKEN",
|
||||||
|
"GITLAB_TOKEN",
|
||||||
|
"AWS_ACCESS_KEY_ID",
|
||||||
|
"AWS_SECRET_ACCESS_KEY",
|
||||||
|
"AZURE_CLIENT_SECRET",
|
||||||
|
"GCP_SA_KEY",
|
||||||
|
"DOCKER_AUTH_CONFIG",
|
||||||
|
"DOCKER_CONFIG",
|
||||||
|
"IG_API_KEY",
|
||||||
|
"IG_ACCESS_TOKEN",
|
||||||
|
"BROKER_API_KEY",
|
||||||
|
"BROKER_TOKEN",
|
||||||
|
"TRADING_TOKEN",
|
||||||
|
"WEBHOOK_SECRET",
|
||||||
|
"SERVICE_ACCOUNT_KEY",
|
||||||
|
"DB_PASSWORD",
|
||||||
|
"POSTGRES_PASSWORD",
|
||||||
|
"MYSQL_PASSWORD",
|
||||||
|
"REDIS_PASSWORD",
|
||||||
|
"MONGO_PASSWORD",
|
||||||
|
]
|
||||||
|
|
||||||
|
# Dateien, die Credentials enthalten koennten (im Home/Config)
|
||||||
|
CREDENTIAL_FILE_PATTERNS = [
|
||||||
|
".netrc",
|
||||||
|
".git-credentials",
|
||||||
|
".pgpass",
|
||||||
|
".my.cnf",
|
||||||
|
".aws/credentials",
|
||||||
|
".config/gcloud/application_default_credentials.json",
|
||||||
|
".docker/config.json",
|
||||||
|
"id_rsa",
|
||||||
|
"id_ed25519",
|
||||||
|
"id_dsa",
|
||||||
|
"id_ecdsa",
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
def check_env() -> list[str]:
|
||||||
|
"""Prueft ENV auf mutierende Credential-Namen. Gibt gefundene Namen zurueck."""
|
||||||
|
found = []
|
||||||
|
for name in MUTATING_CREDENTIAL_NAMES:
|
||||||
|
if name in os.environ:
|
||||||
|
found.append(name)
|
||||||
|
return found
|
||||||
|
|
||||||
|
|
||||||
|
def check_config(config_path: str) -> list[str]:
|
||||||
|
"""Prueft die Worker-Config auf mutierende Credential-Namen.
|
||||||
|
|
||||||
|
Ignoriert Kommentare (Zeilen mit #) — Kommentare sind Dokumentation,
|
||||||
|
keine tatsaechlichen Credentials. Prueft nur echte YAML-Keys/Werte.
|
||||||
|
"""
|
||||||
|
found = []
|
||||||
|
if not os.path.exists(config_path):
|
||||||
|
return found
|
||||||
|
try:
|
||||||
|
with open(config_path, "r", encoding="utf-8") as f:
|
||||||
|
lines = f.readlines()
|
||||||
|
# Nur Nicht-Kommentar-Zeilen pruefen
|
||||||
|
content = "\n".join(
|
||||||
|
line for line in lines if not line.lstrip().startswith("#")
|
||||||
|
)
|
||||||
|
for name in MUTATING_CREDENTIAL_NAMES:
|
||||||
|
if name in content:
|
||||||
|
found.append(name)
|
||||||
|
# Generische Secret-Schluessel in YAML (nur echte Keys, nicht Kommentare)
|
||||||
|
for key in ["token", "api_key", "secret", "password", "bearer"]:
|
||||||
|
if re.search(rf"^\s*{key}\s*:", content, re.IGNORECASE | re.MULTILINE):
|
||||||
|
found.append(f"config-key:{key}")
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return found
|
||||||
|
|
||||||
|
|
||||||
|
def check_home(home: str) -> list[str]:
|
||||||
|
"""Prueft Home-Verzeichnis auf Credential-Dateien/SSH-Keys."""
|
||||||
|
found = []
|
||||||
|
for pattern in CREDENTIAL_FILE_PATTERNS:
|
||||||
|
path = os.path.join(home, pattern)
|
||||||
|
if os.path.exists(path):
|
||||||
|
found.append(pattern)
|
||||||
|
# SSH-Verzeichnis
|
||||||
|
ssh_dir = os.path.join(home, ".ssh")
|
||||||
|
if os.path.isdir(ssh_dir):
|
||||||
|
for entry in os.listdir(ssh_dir):
|
||||||
|
if entry not in ("known_hosts", "config"):
|
||||||
|
found.append(f".ssh/{entry}")
|
||||||
|
return found
|
||||||
|
|
||||||
|
|
||||||
|
def check_git_config(home: str) -> list[str]:
|
||||||
|
"""Prueft git config auf credential helpers."""
|
||||||
|
found = []
|
||||||
|
git_config = os.path.join(home, ".gitconfig")
|
||||||
|
if os.path.exists(git_config):
|
||||||
|
try:
|
||||||
|
with open(git_config, "r", encoding="utf-8") as f:
|
||||||
|
content = f.read()
|
||||||
|
if "credential" in content.lower() and "helper" in content.lower():
|
||||||
|
found.append("git-credential-helper")
|
||||||
|
except Exception:
|
||||||
|
pass
|
||||||
|
return found
|
||||||
|
|
||||||
|
|
||||||
|
def main() -> int:
|
||||||
|
home = os.environ.get("HOME", "/opt/data")
|
||||||
|
config_path = os.environ.get("WORKER_CONFIG", "/opt/l1-worker/worker-config.yaml")
|
||||||
|
|
||||||
|
env_found = check_env()
|
||||||
|
config_found = check_config(config_path)
|
||||||
|
home_found = check_home(home)
|
||||||
|
git_found = check_git_config(home)
|
||||||
|
|
||||||
|
all_found = sorted(set(env_found + config_found + home_found + git_found))
|
||||||
|
|
||||||
|
print("=== CP2A2.2B CREDENTIAL-ZERO TEST ===")
|
||||||
|
print(f"ENV mutating credentials: {env_found if env_found else 'ABSENT'}")
|
||||||
|
print(f"Config mutating credentials: {config_found if config_found else 'ABSENT'}")
|
||||||
|
print(f"Home credential files: {home_found if home_found else 'ABSENT'}")
|
||||||
|
print(f"Git credential helpers: {git_found if git_found else 'ABSENT'}")
|
||||||
|
print(f"TOTAL MUTATING CREDENTIALS: {len(all_found)}")
|
||||||
|
print(f"RESULT: {'PASS' if not all_found else 'FAIL'}")
|
||||||
|
|
||||||
|
return 0 if not all_found else 1
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
|
|
@ -0,0 +1,65 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Network-Negative-Test
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Verifiziert die Netzwerk-Isolation des Workers:
|
||||||
|
# REACHABLE: Gate-Evaluator, Ollama, Tolaria-READ
|
||||||
|
# BLOCKED: Internet generisch, api.telegram.org, api.notion.com,
|
||||||
|
# Forgejo public, SAVE/DELETE executor, Trading/Broker
|
||||||
|
#
|
||||||
|
# Keine sensitiven Daten senden. Nur Connectivity-Checks (read-only).
|
||||||
|
|
||||||
|
import socket
|
||||||
|
import sys
|
||||||
|
|
||||||
|
# Erreichbare interne Ziele (im l1-internal Netz)
|
||||||
|
REACHABLE_TARGETS = [
|
||||||
|
("gate-evaluator", 8080),
|
||||||
|
("ollama-nb6d-ollama-1", 11434),
|
||||||
|
("tolaria", 8325),
|
||||||
|
]
|
||||||
|
|
||||||
|
# Blockierte Ziele (duerfen NICHT erreichbar sein)
|
||||||
|
BLOCKED_TARGETS = [
|
||||||
|
("api.telegram.org", 443),
|
||||||
|
("api.notion.com", 443),
|
||||||
|
("187.124.31.123", 3000), # Forgejo public
|
||||||
|
("8.8.8.8", 53), # generischer Internet-Egress
|
||||||
|
("1.1.1.1", 443), # generischer Internet-Egress
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
def check_reachable(host: str, port: int, timeout: float = 3.0) -> bool:
|
||||||
|
"""Prueft TCP-Erreichbarkeit (read-only, keine Daten gesendet)."""
|
||||||
|
try:
|
||||||
|
with socket.create_connection((host, port), timeout=timeout):
|
||||||
|
return True
|
||||||
|
except Exception:
|
||||||
|
return False
|
||||||
|
|
||||||
|
|
||||||
|
def main() -> int:
|
||||||
|
print("=== CP2A2.2B NETWORK-NEGATIVE TEST ===")
|
||||||
|
|
||||||
|
reachable_results = {}
|
||||||
|
for host, port in REACHABLE_TARGETS:
|
||||||
|
ok = check_reachable(host, port)
|
||||||
|
reachable_results[f"{host}:{port}"] = ok
|
||||||
|
print(f"REACHABLE {host}:{port} = {'OK' if ok else 'UNREACHABLE'}")
|
||||||
|
|
||||||
|
blocked_results = {}
|
||||||
|
for host, port in BLOCKED_TARGETS:
|
||||||
|
ok = check_reachable(host, port)
|
||||||
|
blocked_results[f"{host}:{port}"] = ok
|
||||||
|
print(f"BLOCKED {host}:{port} = {'BLOCKED' if not ok else 'REACHABLE(!)'}")
|
||||||
|
|
||||||
|
# PASS: alle REACHABLE erreichbar, alle BLOCKED blockiert
|
||||||
|
all_reachable_ok = all(reachable_results.values())
|
||||||
|
all_blocked_ok = all(not v for v in blocked_results.values())
|
||||||
|
result = all_reachable_ok and all_blocked_ok
|
||||||
|
|
||||||
|
print(f"RESULT: {'PASS' if result else 'FAIL'}")
|
||||||
|
return 0 if result else 1
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
|
|
@ -0,0 +1,97 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Tool-Capability-Test
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Verifiziert, dass der Worker KEINE verbotenen Tools/Faehigkeiten besitzt.
|
||||||
|
# Verboten: terminal, generic shell, execute_code, write_file auf externe/
|
||||||
|
# shared Ziele, patch, git push, SSH, Docker, cronjob, send_message,
|
||||||
|
# delegation, arbitrary command execution. MAX_SUBAGENTS=0.
|
||||||
|
#
|
||||||
|
# Ground-Truth-Check: prueft die tatsaechlich geladenen Toolsets, nicht nur
|
||||||
|
# die Config. Der Worker nutzt ein minimales read-only Toolset.
|
||||||
|
|
||||||
|
import os
|
||||||
|
import sys
|
||||||
|
|
||||||
|
# Verbotene Tool-Namen (Ground-Truth-Check gegen geladene Toolsets)
|
||||||
|
FORBIDDEN_TOOLS = [
|
||||||
|
"terminal",
|
||||||
|
"process",
|
||||||
|
"execute_code",
|
||||||
|
"write_file",
|
||||||
|
"patch",
|
||||||
|
"git_push",
|
||||||
|
"ssh",
|
||||||
|
"docker",
|
||||||
|
"cronjob",
|
||||||
|
"send_message",
|
||||||
|
"delegate_task",
|
||||||
|
"browser_navigate",
|
||||||
|
"browser_click",
|
||||||
|
"browser_type",
|
||||||
|
"computer_use",
|
||||||
|
]
|
||||||
|
|
||||||
|
# Erlaubte (read-only) Tools
|
||||||
|
ALLOWED_TOOLS = [
|
||||||
|
"web_extract",
|
||||||
|
"web_search",
|
||||||
|
"vision_analyze",
|
||||||
|
"read_file",
|
||||||
|
"search_files",
|
||||||
|
"session_search",
|
||||||
|
"memory",
|
||||||
|
"todo",
|
||||||
|
"clarify",
|
||||||
|
"skills_list",
|
||||||
|
"skill_view",
|
||||||
|
]
|
||||||
|
|
||||||
|
|
||||||
|
def get_loaded_toolsets() -> list[str]:
|
||||||
|
"""Ermittelt die tatsaechlich geladenen Toolsets (Ground Truth)."""
|
||||||
|
# Aus ENV: HERMES_TUI_TOOLSETS oder via hermes CLI
|
||||||
|
env_toolsets = os.environ.get("HERMES_TUI_TOOLSETS", "")
|
||||||
|
if env_toolsets:
|
||||||
|
return [t.strip() for t in env_toolsets.split(",") if t.strip()]
|
||||||
|
return []
|
||||||
|
|
||||||
|
|
||||||
|
def check_forbidden_tools(toolsets: list[str]) -> list[str]:
|
||||||
|
"""Prueft, ob verbotene Tools in den geladenen Toolsets enthalten sind."""
|
||||||
|
found = []
|
||||||
|
# Mapping Toolset -> Tools (statisch, aus toolsets.py Ground Truth)
|
||||||
|
toolset_tools = {
|
||||||
|
"web": ["web_search", "web_extract"],
|
||||||
|
"vision": ["vision_analyze"],
|
||||||
|
"file": ["read_file", "write_file", "patch", "search_files"],
|
||||||
|
"terminal": ["terminal", "process"],
|
||||||
|
"code_execution": ["execute_code"],
|
||||||
|
"delegation": ["delegate_task"],
|
||||||
|
"cronjob": ["cronjob"],
|
||||||
|
"browser": ["browser_navigate", "browser_snapshot", "browser_click",
|
||||||
|
"browser_type", "browser_scroll", "browser_back",
|
||||||
|
"browser_press", "browser_get_images", "browser_console",
|
||||||
|
"web_search"],
|
||||||
|
"computer_use": ["computer_use"],
|
||||||
|
}
|
||||||
|
for ts in toolsets:
|
||||||
|
for tool in toolset_tools.get(ts, []):
|
||||||
|
if tool in FORBIDDEN_TOOLS:
|
||||||
|
found.append(f"{ts}:{tool}")
|
||||||
|
return found
|
||||||
|
|
||||||
|
|
||||||
|
def main() -> int:
|
||||||
|
toolsets = get_loaded_toolsets()
|
||||||
|
forbidden = check_forbidden_tools(toolsets)
|
||||||
|
|
||||||
|
print("=== CP2A2.2B TOOL-CAPABILITY TEST ===")
|
||||||
|
print(f"Loaded toolsets: {toolsets if toolsets else 'NONE (default)'}")
|
||||||
|
print(f"Forbidden tools found: {forbidden if forbidden else 'ABSENT'}")
|
||||||
|
print(f"RESULT: {'PASS' if not forbidden else 'FAIL'}")
|
||||||
|
|
||||||
|
return 0 if not forbidden else 1
|
||||||
|
|
||||||
|
|
||||||
|
if __name__ == "__main__":
|
||||||
|
sys.exit(main())
|
||||||
|
|
@ -0,0 +1,37 @@
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: minimale Hermes-Config (ohne Secrets)
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Diese Config ist die minimale Hermes-Config fuer den Worker.
|
||||||
|
# Sie enthaelt KEINE Credentials (kein Telegram, kein Notion, kein Forgejo,
|
||||||
|
# kein SAVE/DELETE-Token). Provider = Ollama (intern, keine Credentials noetig).
|
||||||
|
#
|
||||||
|
# CREDENTIAL ZERO POLICY: Kein FORGEJO_WRITE_TOKEN, NOTION_API_KEY,
|
||||||
|
# TELEGRAM_BOT_TOKEN, SAVE_TOKEN, DELETE_TOKEN, SSH-Keys, Git-Write-Credentials,
|
||||||
|
# .netrc, .git-credentials, Cloud/DB/Service-Account/Webhook/Bearer/Docker/
|
||||||
|
# Broker/Trading-Credentials.
|
||||||
|
|
||||||
|
model:
|
||||||
|
provider: ollama
|
||||||
|
default: deepseek-v4-flash:cloud
|
||||||
|
context_length: 131072
|
||||||
|
|
||||||
|
providers:
|
||||||
|
ollama:
|
||||||
|
# Interner Ollama-Endpoint (kein Internet-Egress). Keine Credentials noetig.
|
||||||
|
base_url: http://ollama-nb6d-ollama-1:11434/v1
|
||||||
|
context_length: 131072
|
||||||
|
discover_models: true
|
||||||
|
|
||||||
|
agent:
|
||||||
|
verify_on_stop: false
|
||||||
|
|
||||||
|
# KEIN Gateway, KEIN Telegram, KEIN API-Server, KEIN Cron.
|
||||||
|
gateway:
|
||||||
|
telegram:
|
||||||
|
enabled: false
|
||||||
|
|
||||||
|
# KEINE Plugins (keine externen Faehigkeiten).
|
||||||
|
plugins:
|
||||||
|
enabled: []
|
||||||
|
|
||||||
|
_config_version: 33
|
||||||
|
|
@ -0,0 +1,22 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: inert idle Entrypoint
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Dieser Entrypoint startet den Worker als INERTEN idle-Prozess.
|
||||||
|
# Er fuehrt KEINEN autonomen Tick aus, KEINEN Heartbeat, KEINEN Scheduler.
|
||||||
|
# Ein Tick wird ausschliesslich extern getriggert (spaeterer externer Scheduler
|
||||||
|
# -> Gate-Evaluator /check -> ALLOW -> `hermes -z` oneshot via worker-tick.sh).
|
||||||
|
#
|
||||||
|
# In CP2A2.2B existiert der Tick-Wrapper als Datei, wird aber NICHT automatisch
|
||||||
|
# ausgefuehrt. Der Container bleibt inert, bis ein externer Trigger ihn startet.
|
||||||
|
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
echo "[l1-worker] CP2A2.2B L1 Worker Foundation — inert idle (NO AUTONOMY, NO HEARTBEAT, NO SCHEDULER)"
|
||||||
|
echo "[l1-worker] UID=$(id -u) GID=$(id -g) USER=$(id -un)"
|
||||||
|
echo "[l1-worker] Warte auf externen Trigger. Kein autonomer Tick wird gestartet."
|
||||||
|
|
||||||
|
# Inert idle: blockiere, ohne einen autonomen Loop zu starten.
|
||||||
|
# Ein externer Scheduler (spaetere Phase) wuerde `worker-tick.sh` aufrufen.
|
||||||
|
# In CP2A2.2B passiert das NICHT automatisch.
|
||||||
|
exec sleep infinity
|
||||||
60
red-queen-architecture/control-plane/cp2a2_2b/worker-tick.sh
Normal file
60
red-queen-architecture/control-plane/cp2a2_2b/worker-tick.sh
Normal file
|
|
@ -0,0 +1,60 @@
|
||||||
|
#!/bin/sh
|
||||||
|
# CP2A2.2B — L1 Red Queen Worker: Tick-Wrapper (DEFINIERT, NICHT AUTOMATISCH AUSGEFUEHRT)
|
||||||
|
# STRICTLY NON-AUTONOMOUS / NON-PRODUCTIVE.
|
||||||
|
#
|
||||||
|
# Dieser Wrapper fuehrt EINEN einzelnen `hermes -z` oneshot aus.
|
||||||
|
# Er wird in CP2A2.2B NICHT automatisch gestartet (kein Scheduler, kein Loop).
|
||||||
|
# Er dient als technische Foundation fuer spaetere Read-only-Autonomie:
|
||||||
|
# externer Scheduler -> Gate-Evaluator /check -> ALLOW -> worker-tick.sh
|
||||||
|
#
|
||||||
|
# WICHTIG: In CP2A2.2B wird dieser Wrapper NUR als Datei bereitgestellt.
|
||||||
|
# Er wird NICHT vom Entrypoint, NICHT von cron, NICHT von einem Loop aufgerufen.
|
||||||
|
# Kein autonomer Tick darf in dieser Phase laufen.
|
||||||
|
|
||||||
|
set -eu
|
||||||
|
|
||||||
|
# --- Gate-Evaluator /check (read-only, keine Mutation) ---
|
||||||
|
# Der Gate-Evaluator (CP2A1) entscheidet fail-closed. Aktuell:
|
||||||
|
# GLOBAL_AUTONOMY=OFF, PRODUCTIVE_MUTATIONS=OFF, SAVE=OFF, DELETE=OFF,
|
||||||
|
# EMERGENCY_STOP=ON -> AUTONOMOUS_TICK_START = DENY
|
||||||
|
# Daher muss jeder produktive Tick-Start weiterhin DENY ergeben.
|
||||||
|
# KEIN State aendern, um ALLOW zu testen.
|
||||||
|
|
||||||
|
GATE_URL="${GATE_EVALUATOR_URL:-http://gate-evaluator:8080}"
|
||||||
|
ACTION_CLASS="AUTONOMOUS_TICK_START"
|
||||||
|
|
||||||
|
echo "[l1-worker] Gate-Check (read-only): ${GATE_URL}/check action_class=${ACTION_CLASS}"
|
||||||
|
|
||||||
|
# Read-only HTTP-Check via Python (kein curl im Image noetig, kein Shell-Egress).
|
||||||
|
# Der Worker hat KEINE mutierenden Credentials; der Check ist rein lesend.
|
||||||
|
GATE_RESPONSE=$(python3 - <<PYEOF
|
||||||
|
import json, urllib.request
|
||||||
|
try:
|
||||||
|
req = urllib.request.Request(
|
||||||
|
"${GATE_URL}/check",
|
||||||
|
data=json.dumps({"action_class": "${ACTION_CLASS}"}).encode(),
|
||||||
|
headers={"Content-Type": "application/json"},
|
||||||
|
method="POST",
|
||||||
|
)
|
||||||
|
with urllib.request.urlopen(req, timeout=10) as resp:
|
||||||
|
body = resp.read().decode()
|
||||||
|
print(body)
|
||||||
|
except Exception as exc:
|
||||||
|
print(json.dumps({"error": str(exc), "decision": "DENY"}))
|
||||||
|
PYEOF
|
||||||
|
)
|
||||||
|
|
||||||
|
echo "[l1-worker] Gate-Response: ${GATE_RESPONSE}"
|
||||||
|
|
||||||
|
# Fail-closed: Nur bei explizitem ALLOW wuerde ein Tick laufen.
|
||||||
|
# In CP2A2.2B ist das Gate DENY (EMERGENCY_STOP=ON), daher KEIN Tick.
|
||||||
|
DECISION=$(echo "${GATE_RESPONSE}" | python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('decision','DENY'))" 2>/dev/null || echo "DENY")
|
||||||
|
|
||||||
|
if [ "${DECISION}" = "ALLOW" ]; then
|
||||||
|
echo "[l1-worker] WARNUNG: Gate ALLOW — aber CP2A2.2B ist NON-AUTONOMOUS. Tick wird NICHT ausgefuehrt."
|
||||||
|
echo "[l1-worker] Autonome Mission Execution ist in dieser Phase verboten (HARD STOP)."
|
||||||
|
exit 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "[l1-worker] Gate-DECISION=${DECISION} (fail-closed). Kein autonomer Tick in CP2A2.2B."
|
||||||
|
exit 0
|
||||||
Loading…
Reference in a new issue