Documentation
¶
Overview ¶
Command wardyn-verify is Wardyn's in-sandbox environment VERIFY step. It runs INSIDE a governed verify run (launchVerifyRun), in the workspace's BUILT devcontainer image, executes the OPERATOR-APPROVED setup commands (install → build → test/lint) in order, captures each step's exit code + a bounded head+tail of its combined output, and ships the VerifyResult back to the control plane so the workspace's verified state is DERIVED control-plane-side (result-out, not authority-out).
The approved commands arrive via WARDYN_VERIFY_COMMANDS (JSON []workspacescan.SetupCommand) — non-secret, operator-authored. Secrets are NEVER in the sandbox env: the broker proxy-injects api-keys and brokers git creds at request time, so the setup commands reach their registries/hosts through the wardyn-proxy without any secret ever being resident here.
Upload contract (mirrors wardyn-scan — the proxy injects the run token):
PUT ${WARDYN_PROXY_URL}/wardyn/v1/verify-results/${WARDYN_RUN_ID}
body: json(workspacescan.VerifyResult)
Source Files