brama workload check¶
Succeed only when a workload registry pins exactly this process: its uid, its gid, and a binary's resolved path and SHA-256. The launcher runs it before the gateway starts, so a registry that describes another installation is caught before any capability is redeemed.
Invocation¶
brama workload check <REGISTRY> --binary <BINARY> [--json]| Input | Required/default | Meaning |
|---|---|---|
<REGISTRY> | required | The workload registry.json to compare. |
--binary <BINARY> | required | The binary whose resolved path and SHA-256 the registry must pin. |
--json | optional; off | Print the agreement as one JSON document. |
Output¶
On agreement: registry, binary and pinned: true, exit 0. It reads two files and writes nothing.
Refusals¶
Each exits 1:
workload registry disagrees on <name> pinned=<value> actual=<value>— the first field that differs:uid,gid, the binary's path or its digest; a field the registry does not pin reads<name> is not pinned, actual=<value>, and one pinned as something other than text<name> is pinned as <value>, which is not text, actual=<value>.workload registry is unreadable: <error>;workload registry <path> declares no workload<binary>: <error>— the binary could not be read or resolved.