coulomb/audit-core
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

ADHOC-2026-11-07: adopt NK-WP-0058-T07 runbook conventions; unstale CCR seed test

Browse source 
One cluster route (NK_KUBECONFIG, default ~/.kube/config-railiance01) and
server-side apply throughout. Fixes the Makefile dry-run defaulting to the
coulombcore kubeconfig. Lane-run scripts take no default and fail closed when
NK_KUBECONFIG is unset. net-kingdom convention lint: 14 findings -> 0.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 73091@bnt-lap001
Assistant-Session: 9f48906c-6737-449f-8b97-fb86877ca59a
This commit is contained in:
tegwick 2026-11-07 13:25:02 +01:00
parent 782458d327
commit 5649ef90c4
13 changed files with 110 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

2
scripts/attended-mint-tenant-engine-sender.sh
View file

@ -6,7 +6,7 @@
# openbao-ui-railiance01 → http://127.0.0.1:18200. railiance-platform's
# openbao-attended-exec.py pins that address for both OIDC and the child.
set -euo pipefail
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export NK_KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}"
cd "$(dirname "$0")/.."
exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
"$PWD/scripts/mint-tenant-engine-sender.py"

2
scripts/attended-prove-sender-bearer-revocation.sh
View file

@ -2,7 +2,7 @@
# Attended overlap-then-drop proof that a formerly valid audit bearer is 401.
# Uses the operator OpenBao tunnel. Production tokens are not replaced.
set -euo pipefail
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
export NK_KUBECONFIG="${NK_KUBECONFIG:-$HOME/.kube/config-railiance01}"
cd "$(dirname "$0")/.."
exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
"$PWD/scripts/prove-sender-bearer-revocation.py"

8
scripts/attended-seed-nk-bounded-executor-sender.sh
View file

@ -3,10 +3,14 @@
# NK-WP-0056-T15, CCR-2026-0063). Founder-run under
# warden access openbao-platform-admin-login --exec -- <this script> <receipt>
# Results go to the receipt only; any output would fail the warden envelope closed.
# Inside the lane HOME is the warden envelope, so the kubeconfig default is absolute.
# Inside the lane HOME is the warden envelope, so there is no kubeconfig default:
# the caller passes the one cluster route (NK-WP-0058-T07), expanded outside the lane:
# warden access ... --exec -- env NK_KUBECONFIG="$HOME/.kube/config-railiance01" <this script> <receipt>
# Unset, it exits 64 silently before anything runs.
set -euo pipefail
receipt="${1:?receipt path required}"
[[ -n "${NK_KUBECONFIG:-}" ]] || exit 64
exec python3 "$(dirname "$0")/seed-nk-bounded-executor-sender.py" \
--kubeconfig "${RAILIANCE01_KUBECONFIG:-/home/worsch/.kube/config-railiance01}" \
--kubeconfig "$NK_KUBECONFIG" \
--confirm 'SEED nk-bounded-executor CCR-2026-0063' \
--receipt "$receipt" >/dev/null 2>&1

5
scripts/mint-tenant-engine-sender.py
View file

@ -25,7 +25,8 @@ TRADE = (
"declared at tenant-engine/docs/evidence-emission.md"
)
EVIDENCE = Path("/home/worsch/audit-core/docs/evidence/2026-09-15-tenant-engine-sender-mint.json")
KUBECONFIG = os.environ.get("RAILIANCE01_KUBECONFIG", "/home/worsch/.kube/config-railiance01")
# One cluster route (NK-WP-0058-T07), set by the parent wrapper outside the lane.
KUBECONFIG = os.environ.get("NK_KUBECONFIG", "")
RECEIVER_IMAGE = (
"forgejo.coulomb.social/coulomb/audit-core@"
"sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615"
@ -77,6 +78,8 @@ def bao(args: list[str], *, payload: dict | None = None) -> dict:
def kube(args: list[str]) -> subprocess.CompletedProcess:
if not KUBECONFIG: # an empty --kubeconfig would fall back to a second, default route
raise SystemExit(64)
return subprocess.run(
["kubectl", "--kubeconfig", KUBECONFIG, "--request-timeout=30s", *args],
stdout=subprocess.PIPE,

7
scripts/prove-sender-bearer-revocation.py
View file

@ -19,9 +19,8 @@ from datetime import datetime, timezone
from pathlib import Path
REGISTRY = "platform/data/workloads/audit-core/senders"
KUBECONFIG = os.environ.get(
"RAILIANCE01_KUBECONFIG", "/home/worsch/.kube/config-railiance01"
)
# One cluster route (NK-WP-0058-T07), set by the parent wrapper outside the lane.
KUBECONFIG = os.environ.get("NK_KUBECONFIG", "")
IMAGE = (
"forgejo.coulomb.social/coulomb/audit-core@"
"sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615"
@ -94,6 +93,8 @@ def bao(args: list[str], *, payload: dict | None = None) -> dict:
def kube(args: list[str], *, input_bytes: bytes | None = None) -> subprocess.CompletedProcess:
if not KUBECONFIG: # an empty --kubeconfig would fall back to a second, default route
raise SystemExit(64)
return subprocess.run(
["kubectl", "--kubeconfig", KUBECONFIG, "--request-timeout=30s", *args],
input=input_bytes,

2
scripts/prove-tenant-engine-accept.py
View file

@ -18,7 +18,7 @@ import uuid
from datetime import datetime, timezone
from pathlib import Path
KUBECONFIG = os.environ.get("RAILIANCE01_KUBECONFIG", str(Path.home() / ".kube/config-railiance01"))
KUBECONFIG = os.environ.get("NK_KUBECONFIG", str(Path.home() / ".kube/config-railiance01"))
IMAGE = (
"forgejo.coulomb.social/coulomb/audit-core@"
"sha256:ec15f63d49226bfe507af2bc38ffbd5e83f549ba2c6d1ae7a338e7e053f34615"

10
scripts/renew-runtime-lease.sh
View file

@ -12,14 +12,16 @@
# even when the command succeeds. Persist metadata only. Never print a token.
#
# warden access openbao-platform-admin-login --exec -- \
# env RAILIANCE01_KUBECONFIG="$HOME/.kube/config-railiance01" \
# env NK_KUBECONFIG="$HOME/.kube/config-railiance01" \
# BAO_ADDR=http://127.0.0.1:18200 \
# /home/worsch/audit-core/scripts/renew-runtime-lease.sh
set -euo pipefail
ROOT="$(cd "$(dirname "$0")/.." && pwd)"
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-/home/worsch/.kube/config-railiance01}"
export KUBECONFIG="$RAILIANCE01_KUBECONFIG"
# One cluster route (NK-WP-0058-T07). No default: HOME inside the lane is the
# warden envelope. Unset, the kubeconfig check below fails closed with evidence.
export NK_KUBECONFIG="${NK_KUBECONFIG:-}"
export KUBECONFIG="$NK_KUBECONFIG"
# bao.coulomb.social is retired (2026-09-15); the tunnel is the operator path.
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
# Contained login persists the session in $HOME/.vault-token and unsets
@ -68,7 +70,7 @@ if ! command -v kubectl >/dev/null 2>&1; then
_write_evidence failed '{"reason": "kubectl_missing"}'
exit 1
fi
if [[ ! -f "$RAILIANCE01_KUBECONFIG" ]]; then
if [[ ! -f "$NK_KUBECONFIG" ]]; then
_write_evidence failed '{"reason": "kubeconfig_missing"}'
exit 1
fi