admin343/browser
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Freeze SCUM guarded mutation run contract

Browse Source
This commit is contained in:
npc0-hue
2026-08-13 14:04:44 +08:00
parent ac6f5419fe
commit 41c109128d
17 changed files with 741 additions and 37 deletions
Download Patch File Download Diff File Expand all files Collapse all files
platform/validator/resources.go
+19
View File
@@ -1552,6 +1552,20 @@ func ValidateJob(job domain.Job) error {
violations = append(violations, "executionInput.rconTemplate requires a protected rcon transport plan")
}
}
if job.ExecutionInput.GuardedMutation != nil {
if err := ValidateSCUMGuardedMutationRequest(*job.ExecutionInput.GuardedMutation); err != nil {
violations = append(violations, "executionInput.guardedMutation: "+err.Error())
}
if job.Capability != domain.JobCapabilityRemoteRunProtectedSQL {
violations = append(violations, "executionInput.guardedMutation is allowed only for protected sql jobs")
}
if job.ExecutionInput.RemoteAdapterKind != "protected-sql" {
violations = append(violations, "executionInput.guardedMutation requires a protected sql transport plan")
}
if len(job.ExecutionInput.Inputs) != 0 || job.ExecutionInput.Content != "" {
violations = append(violations, "executionInput.guardedMutation must not persist raw adapter inputs")
}
}
violations = append(violations, validateRemoteAdapterInputs("executionInput.inputs", job.ExecutionInput.Inputs)...)
if job.ExecutionResult.Checksum != "" && !validSHA256Checksum(job.ExecutionResult.Checksum) {
violations = append(violations, "executionResult.checksum must be sha256:<hex>")
@@ -1577,6 +1591,11 @@ func ValidateJob(job domain.Job) error {
violations = append(violations, "executionResult.rconTemplate: "+err.Error())
}
}
if job.ExecutionResult.GuardedMutation != nil {
if err := ValidateSCUMGuardedMutationResult(*job.ExecutionResult.GuardedMutation); err != nil {
violations = append(violations, "executionResult.guardedMutation: "+err.Error())
}
}
if job.Capability == domain.JobCapabilityConfigWrite || job.Capability == domain.JobCapabilityFilesRead || job.Capability == domain.JobCapabilityFilesWrite {
if job.ServerInstanceID == "" {
violations = append(violations, "serverInstanceId is required for scoped file jobs")