coulomb/audit-core
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Add attended overlap-then-drop bearer revocation proof

Browse source 
T09/T11 remaining gate: a formerly valid T1 is 401 after drop, while
the production T0 still 202. Does not replace live factory tokens.

Assistant: grok
Assistant-Session: 01a0a182-bab7-7f11-b32b-d06f3af52082
This commit is contained in:
tegwick 2026-09-15 22:27:01 +02:00
parent d9b3e7d155
commit ff74dbce63
2 changed files with 414 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/attended-prove-sender-bearer-revocation.sh Executable file
View file

@ -0,0 +1,8 @@
#!/usr/bin/env bash
# Attended overlap-then-drop proof that a formerly valid audit bearer is 401.
# Uses the operator OpenBao tunnel. Production tokens are not replaced.
set -euo pipefail
export RAILIANCE01_KUBECONFIG="${RAILIANCE01_KUBECONFIG:-$HOME/.kube/config-railiance01}"
cd "$(dirname "$0")/.."
exec python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
"$PWD/scripts/prove-sender-bearer-revocation.py"