coulomb/activity-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0039-T03: add non-secret status trace to the seeding script

Browse source 
warden discards child output, so the first attended run's failure gave no
cause. Record the step, exit code, and bao error text to an optional status
file, never the token value. Tested against a stub bao: silent and a no-op on
rerun.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 151606@bnt-lap001
Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48
This commit is contained in:
tegwick 2026-09-23 17:56:31 +02:00
parent a129249d25
commit ebb12b00c7
1 changed files with 31 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

37
scripts/wp0039-seed-worker-tokens.sh
View file

@ -4,6 +4,7 @@
# Founder-attended only, through the silent admin lane (orientation section 5):
#
# BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \
# WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \
# warden access openbao-platform-admin-login --exec -- \
# sh scripts/wp0039-seed-worker-tokens.sh
#
@ -12,29 +13,53 @@
# argv, output, Git, or the hub. Idempotent: an existing path is never
# overwritten. Rerunning after success is a no-op that re-verifies.
#
# WP0039_STATUS (optional, absolute path outside warden's temporary HOME)
# receives a non-secret trace: step, exit code, and bao's error text for
# metadata/put calls. The token-read step records only its stderr and length;
# its stdout (the value) is never written anywhere.
#
# Exit codes: 0 both paths present and verified · 3 a path exists without a
# usable token field (left untouched) · 4 write failed · 5 verification failed.
# usable token field (left untouched) · 4 write failed · 5 verification failed
# · 6 a required tool is missing.
exec >/dev/null 2>&1
set -u
MOUNT=platform
BASE=workloads/activity-core/ops-run-workers
PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01"
STATUS="${WP0039_STATUS:-/dev/null}"
ERR="$(mktemp)"
trap 'rm -f "$ERR"' EXIT
: >"$STATUS"
note() { printf '%s\n' "$*" >>"$STATUS"; }
fail() { note "exit $1 at $2"; sed 's/^/ bao: /' "$ERR" >>"$STATUS"; exit "$1"; }
for tool in bao openssl; do
command -v "$tool" || { note "missing tool: $tool"; exit 6; }
done
note "BAO_ADDR=${BAO_ADDR:-unset}"
token_len() {
bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c
bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>"$ERR" | tr -d '\n' | wc -c | tr -d ' '
}
for slug in $PATHS; do
if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then
[ "$(token_len "$slug")" -eq 64 ] || exit 3
if bao kv metadata get -mount="$MOUNT" "$BASE/$slug" 2>"$ERR"; then
note "$slug: exists"
[ "$(token_len "$slug")" -eq 64 ] || fail 3 "verify-existing $slug"
continue
fi
note "$slug: metadata lookup failed (treated as absent):"
sed 's/^/ bao: /' "$ERR" >>"$STATUS"
openssl rand -hex 32 | tr -d '\n' \
| bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4
| bao kv put -mount="$MOUNT" "$BASE/$slug" token=- 2>"$ERR" || fail 4 "put $slug"
note "$slug: written"
done
for slug in $PATHS; do
[ "$(token_len "$slug")" -eq 64 ] || exit 5
[ "$(token_len "$slug")" -eq 64 ] || fail 5 "verify $slug"
note "$slug: verified"
done
note "exit 0"
exit 0