enumeray connector execute-once

Execute or resume one prepared assignment using durable backend evidence.

Use when: A one-shot claim prepared work, or a stopped one-shot owner needs bounded recovery.

Role and prerequisites: Connector host operator. Install enumeray on the execution control host. Retain its private journal on durable storage; keep one process owner and the matching connector credential. See recovery rules before taking over retained state.

Example

enumeray connector execute-once --journal ./local-journal --token-file ./connector-state/token

No prepared assignment means there is no new work to execute. This is not a replacement for the supervised run service. Add --credentials-file for SSH contexts and --log-policy-file when using an explicit connector log policy.

Inputs and options

Input	Meaning and use
--log-policy-file <LOG_POLICY_FILE>	Connector-owned log capture/archive policy JSON, pinned before launching an assignment. Start from the log policy example and choose bounded capture and retention.
--journal <JOURNAL>	Private durable journal directory. Reuse the same path after restart and never copy it to create another active connector. It contains ownership and backend execution evidence.
--token-file <TOKEN_FILE>	Private regular file containing only the connector bearer token, typically the token file written by enroll. One-shot commands read a token from stdin if omitted.
--confirm-prior-process-stopped	Explicit recovery assertion that the journal’s previous process stopped on every host, including out-of-band processes. Establish this externally before using the flag; it is not a backend cancellation command.
--simulate-lost-submission-ack	Recovery qualification option that loses a backend submission acknowledgement deliberately. Use only in a disposable test to verify recovery without duplicate launch.
--credentials-file <CREDENTIALS_FILE>	Private JSON map from SSH credential references in contexts to private key files on the connector host. OpenSSH runs as the connector OS account: provision the verified remote host key in that account’s ~/.ssh/known_hosts. Install the matching public key in the remote execution account’s authorized_keys. The private map stays on the connector host; see SSH context examples.
--allow-development-execution	Explicit host consent for trusted same-user process/direct development contexts. Required on every launch-capable invocation. Managed identity separation remains enforced; model code can access this OS user’s connector credentials and files.

Host commands use explicit connector credentials or the private journal and emit JSON results; compute-runner uses only its stdin protocol and directory. User profile and API override options do not apply.

Result and next step

Performs or resumes the retained assignment’s execution/transfer/result steps. Lost backend submission acknowledgement remains evidence to reconcile, never permission to submit another job.

Inspect the journal and run state; use the documented recovery assertion only after establishing stopped ownership.

Exact syntax, defaults and accepted values

Execute or resume one prepared assignment, retaining durable backend evidence

Usage: enumeray connector execute-once [OPTIONS] --journal <JOURNAL>

Options:
      --api <API>
          User API origin override; credentials never cross origins. Host/runner commands use explicit configuration
      --log-policy-file <LOG_POLICY_FILE>
          Connector-owned log capture/archive policy JSON; omit for the bounded default policy
      --journal <JOURNAL>
          Existing private durable journal containing the prepared assignment; retain for recovery
      --profile <PROFILE>
          Named local user API/login profile; host/runner commands use explicit configuration [default: default]
      --config <CONFIG>
          Private user profiles file; defaults to $XDG_CONFIG_HOME/enumeray/profiles.json or ~/.config/enumeray/profiles.json
      --token-file <TOKEN_FILE>
          Private regular file containing the connector bearer token; omit to read token text from stdin
      --confirm-prior-process-stopped
          Assert that the journal's previous process stopped on every host before recovery
      --json
          Emit user API results as JSON (NDJSON for following logs) and runtime errors on stderr; host/runner output follows its own protocol
      --simulate-lost-submission-ack
          Exercise recovery after a backend commit whose acknowledgement is lost
      --timeout <TIMEOUT>
          User API HTTP timeout in seconds; live logs use it for read inactivity. Does not limit execution time [default: 60]
      --credentials-file <CREDENTIALS_FILE>
          Private credential-reference map used while compiling API configuration
      --allow-development-execution
          Permit trusted process/direct development contexts under this regular OS user
  -h, --help
          Print help