7a55b259bf
Three fenced worker Pods claim Hermes Kanban runs through a coordinator that owns every state transition, with per-ordinal HMAC authority, a mediated broker-only SCM path, and durable per-ordinal workspaces. Content is the reviewed head of PR #18 (689bcb6e) with PR 16's and PR 19's contributions removed: they were merged in only to validate co-existence and are not prerequisites, so this branch no longer carries them as ancestors. Only PR 14 and PR 15 remain, because the broker boundary and the cli_lane_* decomposition are load-bearing for two of the fixed P0 boundaries. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
13 lines
439 B
YAML
13 lines
439 B
YAML
apiVersion: v1
|
|
kind: ServiceAccount
|
|
metadata:
|
|
name: hermes-execution-worker
|
|
namespace: hermes
|
|
labels:
|
|
app.kubernetes.io/name: hermes-execution-worker
|
|
app.kubernetes.io/part-of: hermes
|
|
automountServiceAccountToken: false
|
|
# Intentionally no RoleBinding or ClusterRoleBinding. The projected, bounded
|
|
# token is mounted only into Vault-facing containers and grants no Kubernetes
|
|
# API verbs to the model-facing execution worker.
|