From ebb12b00c7eb97f50d3286a714a42ea59184cef4 Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 17:56:31 +0200 Subject: [PATCH 1/2] WP-0039-T03: add non-secret status trace to the seeding script warden discards child output, so the first attended run's failure gave no cause. Record the step, exit code, and bao error text to an optional status file, never the token value. Tested against a stub bao: silent and a no-op on rerun. Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 151606@bnt-lap001 Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48 --- scripts/wp0039-seed-worker-tokens.sh | 37 +++++++++++++++++++++++----- 1 file changed, 31 insertions(+), 6 deletions(-) diff --git a/scripts/wp0039-seed-worker-tokens.sh b/scripts/wp0039-seed-worker-tokens.sh index efa6764..9f2fe23 100755 --- a/scripts/wp0039-seed-worker-tokens.sh +++ b/scripts/wp0039-seed-worker-tokens.sh @@ -4,6 +4,7 @@ # Founder-attended only, through the silent admin lane (orientation section 5): # # BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ +# WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \ # warden access openbao-platform-admin-login --exec -- \ # sh scripts/wp0039-seed-worker-tokens.sh # @@ -12,29 +13,53 @@ # argv, output, Git, or the hub. Idempotent: an existing path is never # overwritten. Rerunning after success is a no-op that re-verifies. # +# WP0039_STATUS (optional, absolute path outside warden's temporary HOME) +# receives a non-secret trace: step, exit code, and bao's error text for +# metadata/put calls. The token-read step records only its stderr and length; +# its stdout (the value) is never written anywhere. +# # Exit codes: 0 both paths present and verified · 3 a path exists without a -# usable token field (left untouched) · 4 write failed · 5 verification failed. +# usable token field (left untouched) · 4 write failed · 5 verification failed +# · 6 a required tool is missing. exec >/dev/null 2>&1 set -u MOUNT=platform BASE=workloads/activity-core/ops-run-workers PATHS="rein-aharness-railiance01 rein-aharness-metered-railiance01" +STATUS="${WP0039_STATUS:-/dev/null}" +ERR="$(mktemp)" +trap 'rm -f "$ERR"' EXIT +: >"$STATUS" + +note() { printf '%s\n' "$*" >>"$STATUS"; } +fail() { note "exit $1 at $2"; sed 's/^/ bao: /' "$ERR" >>"$STATUS"; exit "$1"; } + +for tool in bao openssl; do + command -v "$tool" || { note "missing tool: $tool"; exit 6; } +done +note "BAO_ADDR=${BAO_ADDR:-unset}" token_len() { - bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>/dev/null | tr -d '\n' | wc -c + bao kv get -mount="$MOUNT" -field=token "$BASE/$1" 2>"$ERR" | tr -d '\n' | wc -c | tr -d ' ' } for slug in $PATHS; do - if bao kv metadata get -mount="$MOUNT" "$BASE/$slug"; then - [ "$(token_len "$slug")" -eq 64 ] || exit 3 + if bao kv metadata get -mount="$MOUNT" "$BASE/$slug" 2>"$ERR"; then + note "$slug: exists" + [ "$(token_len "$slug")" -eq 64 ] || fail 3 "verify-existing $slug" continue fi + note "$slug: metadata lookup failed (treated as absent):" + sed 's/^/ bao: /' "$ERR" >>"$STATUS" openssl rand -hex 32 | tr -d '\n' \ - | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- || exit 4 + | bao kv put -mount="$MOUNT" "$BASE/$slug" token=- 2>"$ERR" || fail 4 "put $slug" + note "$slug: written" done for slug in $PATHS; do - [ "$(token_len "$slug")" -eq 64 ] || exit 5 + [ "$(token_len "$slug")" -eq 64 ] || fail 5 "verify $slug" + note "$slug: verified" done +note "exit 0" exit 0 From 482c868f2fbfed7e19926f3d9c12321d4f8462bc Mon Sep 17 00:00:00 2001 From: tegwick Date: Wed, 23 Sep 2026 17:56:52 +0200 Subject: [PATCH 2/2] WP-0039-T03: document status trace and first failed run Co-Authored-By: Claude Opus 5.5 Assistant: claude-code Assistant-Model: opus Assistant-Process: 151606@bnt-lap001 Assistant-Session: 3c0a4ad5-bb8b-4bf7-b9f0-fa5f29204e48 --- ...VITY-WP-0039-multi-worker-identity-and-token-custody.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md b/workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md index f6d80dc..23b9a50 100644 --- a/workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md +++ b/workplans/ACTIVITY-WP-0039-multi-worker-identity-and-token-custody.md @@ -133,10 +133,17 @@ on stdin. The founder runs it in their own terminal: ```bash BAO_ADDR=http://127.0.0.1:18200 VAULT_ADDR=http://127.0.0.1:18200 \ + WP0039_STATUS=$HOME/.local/state/wp0039-seed.status \ warden access openbao-platform-admin-login --exec -- \ sh scripts/wp0039-seed-worker-tokens.sh ``` +The first founder run on 2026-09-23 failed closed ("returned a failure or +unexpected output"). warden discards the child's output, so the script now +writes a non-secret step trace to `WP0039_STATUS`. The trace holds the failing +step, the exit code, and bao's error text, never the value. The script was +tested against a stub `bao`: silent, and a no-op on rerun. + Read warden's printed line rather than its exit code (orientation section 5). Minting does not depend on T02, but ESO cannot read the paths until the policy lands.