feat(werkbank): job/result contract in compliance-core (WB-01) #205

2026-07-17T08:25:04Z

sharang commented

2026-07-17 08:25:04 +00:00

First story of the Werkbank epic (sharang/werkbank#1) — implements sharang/werkbank#2.

Adds the shared, dependency-free vocabulary the control plane and the Werkbank execution runner agree on, in a new compliance-core::models::werkbank module:

Job — declarative (TOML on disk, JSON on the wire): id, type, tenant, target_id, executor, labels, timeout, inputs, runtime, collect.
JobType — plc-provision / qemu-boot / dast / pentest.
Executor — shell / docker / k8s (the CI-runner classification; QEMU runs in the Docker executor).
JobStatus — queued → leased → running → succeeded/failed/expired/cancelled, with is_terminal().
InputRef — blob (content-hash) or url; the artifact resolves on the runner, never through the control plane (so an on-prem runner keeps customer data local).
JobResult — reuses Finding / DastFinding / SbomEntry, so the runner produces exactly what the control plane persists; idempotent by job_id.

Feature-free: the module avoids the mongodb/axum features so the runner (separate repo) can depend on compliance-core without the server stack — verified with cargo check -p compliance-core --no-default-features.

Tests (5): JSON round-trip; parsing the exact plc-provision and qemu-boot TOML from the design doc §5; status terminality; result constructors. clippy + fmt clean.

Note: CI has no runner registered at the moment — verified the check steps locally (fmt, clippy -p compliance-agent -D warnings, feature-free check, tests).

🤖 Generated with Claude Code

First story of the **Werkbank** epic (sharang/werkbank#1) — implements sharang/werkbank#2. Adds the shared, dependency-free vocabulary the control plane and the Werkbank execution runner agree on, in a new `compliance-core::models::werkbank` module: - **`Job`** — declarative (TOML on disk, JSON on the wire): id, type, tenant, target_id, executor, labels, timeout, inputs, runtime, collect. - **`JobType`** — `plc-provision` / `qemu-boot` / `dast` / `pentest`. - **`Executor`** — `shell` / `docker` / `k8s` (the CI-runner classification; QEMU runs in the Docker executor). - **`JobStatus`** — queued → leased → running → succeeded/failed/expired/cancelled, with `is_terminal()`. - **`InputRef`** — blob (content-hash) or url; the artifact resolves **on the runner**, never through the control plane (so an on-prem runner keeps customer data local). - **`JobResult`** — reuses `Finding` / `DastFinding` / `SbomEntry`, so the runner produces exactly what the control plane persists; idempotent by `job_id`. **Feature-free:** the module avoids the `mongodb`/`axum` features so the runner (separate repo) can depend on `compliance-core` without the server stack — verified with `cargo check -p compliance-core --no-default-features`. **Tests (5):** JSON round-trip; parsing the exact `plc-provision` and `qemu-boot` TOML from [the design doc §5](https://gitea.meghsakha.com/sharang/werkbank/src/branch/main/docs/DESIGN.md); status terminality; result constructors. clippy + fmt clean. Note: CI has no runner registered at the moment — verified the check steps locally (fmt, `clippy -p compliance-agent -D warnings`, feature-free check, tests). 🤖 Generated with [Claude Code](https://claude.com/claude-code)

sharang added 1 commit 2026-07-17 08:25:05 +00:00

feat(werkbank): job/result contract in compliance-core (WB-01)

CI / Check (pull_request) Successful in 5m44s

Details

CI / Detect Changes (pull_request) Has been skipped

Details

CI / Deploy Agent (pull_request) Has been skipped

Details

CI / Deploy Dashboard (pull_request) Has been skipped

Details

CI / Deploy Docs (pull_request) Has been skipped

Details

CI / Deploy MCP (pull_request) Has been skipped

Details

463d4f6eb2

The shared, dependency-free vocabulary the control plane and the Werkbank
execution runner agree on: Job (declarative — TOML on disk, JSON on the wire),
JobType (plc-provision/qemu-boot/dast/pentest), Executor (shell/docker/k8s),
JobStatus lifecycle, InputRef (blob/url — the artifact resolves on the runner,
never through the control plane), JobRuntime, JobCollect, and JobResult (reusing
Finding/DastFinding/SbomEntry so the runner produces exactly what the control
plane persists).

Lives in a mongodb/axum-feature-free module so the runner can depend on
compliance-core without the server stack (verified: cargo check -p
compliance-core --no-default-features). Tests round-trip through JSON and parse
the exact plc-provision + qemu-boot TOML from the Werkbank design doc.

First story of the Werkbank epic (sharang/werkbank#1); implements
sharang/werkbank#2.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

sharang merged commit 7b218fffef into main

2026-07-17 08:54:12 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sharang/compliance-scanner-agent#205