Stores ExecutionToken records. One token per token_id. Tokens are immutable once issued.
| 96 | |
| 97 | |
| 98 | class ExecutionTokenModel(BaseModel): |
| 99 | """ |
| 100 | Stores ExecutionToken records. |
| 101 | One token per token_id. Tokens are immutable once issued. |
| 102 | """ |
| 103 | |
| 104 | __tablename__: str = "sys_orgkernel_execution_token" |
| 105 | __table_args__ = ( |
| 106 | Index("idx_token_agent_id", "agent_id"), |
| 107 | Index("idx_token_mission_id", "mission_id"), |
| 108 | Index("idx_token_expires", "expires_at"), |
| 109 | {"comment": "OrgKernel ExecutionToken — scoped, time-bounded execution permission"}, |
| 110 | ) |
| 111 | |
| 112 | token_id: Mapped[str] = mapped_column( |
| 113 | String(32), primary_key=True, comment="tok_ prefixed global ID" |
| 114 | ) |
| 115 | agent_id: Mapped[str] = mapped_column( |
| 116 | String(32), nullable=False, |
| 117 | comment="FK -> sys_orgkernel_agent_identity.agent_id", |
| 118 | ) |
| 119 | mission_id: Mapped[str] = mapped_column( |
| 120 | String(32), nullable=False, index=True, |
| 121 | comment="Mission this token is scoped to", |
| 122 | ) |
| 123 | execution_scope_json: Mapped[str] = mapped_column( |
| 124 | Text, nullable=False, |
| 125 | comment="execution_scope list serialized as JSON", |
| 126 | ) |
| 127 | immutable_params_json: Mapped[str | None] = mapped_column( |
| 128 | Text, nullable=True, |
| 129 | comment="immutable_params dict serialized as JSON", |
| 130 | ) |
| 131 | bounded_params_json: Mapped[str | None] = mapped_column( |
| 132 | Text, nullable=True, |
| 133 | comment="bounded_params list serialized as JSON", |
| 134 | ) |
| 135 | issued_at: Mapped[datetime] = mapped_column( |
| 136 | DateTime, nullable=False, |
| 137 | comment="UTC issuance timestamp", |
| 138 | ) |
| 139 | expires_at: Mapped[datetime] = mapped_column( |
| 140 | DateTime, nullable=False, |
| 141 | comment="UTC expiry timestamp", |
| 142 | ) |
| 143 | boundary_snapshot_id: Mapped[str | None] = mapped_column( |
| 144 | String(32), nullable=True, |
| 145 | comment="FK -> MissionBoundary snapshot ID", |
| 146 | ) |
| 147 | token_signature: Mapped[str | None] = mapped_column( |
| 148 | Text, nullable=True, |
| 149 | comment="Ed25519 signature by Org CA over canonical token payload", |
| 150 | ) |
| 151 | used: Mapped[bool] = mapped_column( |
| 152 | Boolean, nullable=False, default=False, |
| 153 | comment="True if consumed", |
| 154 | ) |
| 155 | invalidated_at: Mapped[datetime | None] = mapped_column( |