audit-core/scripts/attended-mint-tenant-engine-sender.sh

#!/usr/bin/env bash
# Parent-env wrapper for the attended tenant-engine sender mint.
#
# Public https://bao.coulomb.social was retracted 2026-09-15
# (RMASTER-WP-0020-T09). Operator login is the named tunnel
# openbao-ui-railiance01 → http://127.0.0.1:18200. railiance-platform's
# openbao-attended-exec.py pins that address for both OIDC and the child.
set -euo pipefail
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
cd "$(dirname "$0")/.."
exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
  "$PWD/scripts/mint-tenant-engine-sender.py"
Export BAO_ADDR in the parent before attended sender mint warden access runs OIDC from the caller environment. Putting BAO_ADDR only on the child env argv leaves bao login talking to the wrong address, which fails before command handoff. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082 2026-09-15 21:42:01 +02:00			`#!/usr/bin/env bash`
			`# Parent-env wrapper for the attended tenant-engine sender mint.`
			`#`
Pin attended sender mint to the operator OpenBao tunnel Public bao.coulomb.social was retracted today and now presents Traefik's default certificate. Login must use http://127.0.0.1:18200 via openbao-attended-exec.py, matching the sitting-requester path. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082 2026-09-15 21:59:28 +02:00			`# Public https://bao.coulomb.social was retracted 2026-09-15`
			`# (RMASTER-WP-0020-T09). Operator login is the named tunnel`
			`# openbao-ui-railiance01 → http://127.0.0.1:18200. railiance-platform's`
			`# openbao-attended-exec.py pins that address for both OIDC and the child.`
Export BAO_ADDR in the parent before attended sender mint warden access runs OIDC from the caller environment. Putting BAO_ADDR only on the child env argv leaves bao login talking to the wrong address, which fails before command handoff. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082 2026-09-15 21:42:01 +02:00			`set -euo pipefail`
			`export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"`
			`cd "$(dirname "$0")/.."`
Pin attended sender mint to the operator OpenBao tunnel Public bao.coulomb.social was retracted today and now presents Traefik's default certificate. Login must use http://127.0.0.1:18200 via openbao-attended-exec.py, matching the sitting-requester path. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082 2026-09-15 21:59:28 +02:00			`exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \`
Export BAO_ADDR in the parent before attended sender mint warden access runs OIDC from the caller environment. Putting BAO_ADDR only on the child env argv leaves bao login talking to the wrong address, which fails before command handoff. Assistant: grok Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082 2026-09-15 21:42:01 +02:00			`"$PWD/scripts/mint-tenant-engine-sender.py"`