feat(ops): pass the claiming worker to session commands

README.md

@@ -18,6 +18,10 @@ resolution (`$TRAUST_CONFIG_HOME`, `locations.yaml`) belongs to traust-core's `C
 The engine imports only traust-core's public API: `traust_core.v1.context`, `models` and
 `errors` (the consumer ratchet in CI holds it there).
 
+Command templates can use `{worker}` alongside `{run_id}`, `{repo_url}`, `{role}` and
+`{rule}`. `{worker}` is the claiming runner's ID, so artifact-only session commands can
+record their audit evidence under the same lease; claim, heartbeat and completion are unchanged.
+
 ## Install
 
 Private Git (after tags are published):

pyproject.toml

@@ -20,7 +20,7 @@ traust-engine = "traust_engine.ops.cli:main"
 dev = ["pytest>=9.1.1", "pytest-xdist>=3", "ruff>=0.6", "vulture>=2.16"]
 
 [tool.uv.sources]
-traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "2bdc2d6d5435820a934c1094ae1901599710dfd0" }
+traust-core = { git = "https://github.com/traust-security/traust-core.git", rev = "acf67b8a4409ed7afa1b79d7954636b5b169fa64" }
 
 [tool.hatch.build.targets.wheel]
 packages = ["src/traust_engine"]

src/traust_engine/ops/runner.py

@@ -130,7 +130,7 @@ def _values(self, order: RunOrder, spec: AssetSpec) -> dict[str, str]:
         """What the order supplies: its id, the asset's model role, the rule that routed it, and
         its repository's URL for a per-repository asset. NEED(model: order params): typed params
         beyond the repository have no column yet."""
-        values = {"run_id": str(order.id)}
+        values = {"run_id": str(order.id), "worker": str(self._worker)}
         if spec.model is not None:
             values["role"] = spec.model.role
         if order.rule is not None:

tests/test_ops_shadow.py

@@ -169,7 +169,10 @@ def _done(code: int, stdout: str = "") -> subprocess.CompletedProcess[str]:
     ("done", "want"),
     [
         (_done(4, JobResult.partly({"kev": 1}).model_dump_json()), JobResult.partly({"kev": 1})),
-        (_done(5, "log\n" + JobResult.refused("x").model_dump_json()), JobResult.refused("x")),
+        (
+            _done(5, "log\n" + JobResult.refused(OrderReason.NOT_FOUND).model_dump_json()),
+            JobResult.refused(OrderReason.NOT_FOUND),
+        ),
         (_done(0, "done"), JobResult.succeeded()),
         (_done(0), JobResult.succeeded()),
         (_done(3, "{not json"), JobResult.failed(OrderReason.RUNNER_CRASHED)),

tests/test_session_worker_handoff.py

@@ -0,0 +1,24 @@
+from __future__ import annotations
+
+from datetime import timedelta
+
+import yaml
+from test_ops_runner import HOSTS, PACK, WORKER, Commands, _submit
+from test_ops_runner import context as context
+from traust_core.v1.context import Context
+from traust_core.v1.models.operations import OrderState
+
+from traust_engine.ops.pack import Pack
+from traust_engine.ops.runner import Runner
+
+
+def test_a_session_receives_the_claiming_worker_and_order(context: Context) -> None:
+    raw = yaml.safe_load(PACK.read_text())
+    raw["assets"]["diff_scan"]["run"] = ["session", "--run-id", "{run_id}", "--worker", "{worker}"]
+    order = _submit(context, "diff_scan", repo=True)
+    commands = Commands()
+    result = Runner(
+        context.services(), Pack.model_validate(raw), WORKER, timedelta(minutes=5), HOSTS, commands
+    ).claim_once()
+    assert commands.seen == [["session", "--run-id", str(order.id), "--worker", str(WORKER)]]
+    assert result.state == OrderState.SUCCEEDED and result.lease_holder is None