coulomb/net-kingdom
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NK-WP-0058-T03 step 1: name the causes (window-command identity phase, approval_entry field)

Browse source 
executor-lanes.py: the identity phase distinguishes openbao_unreachable, openbao_sealed and
platform_admin_login_required, with a one-line hint; LaneError keeps its fixed code. executor.py:
approval_entry:<approver_not_listed|not_human|not_aal2|self_approval>, never the subject.
Note: executor.py changed, so the next admission pins a new image.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 943911@bnt-lap001
Assistant-Session: fc322940-1c8e-4bed-ab39-86cec99f23a0
This commit is contained in:
tegwick 2026-11-05 23:24:08 +01:00
parent f85a22d245
commit 7350ba8003
7 changed files with 103 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

20
bounded-executor/executor.py
View file

@ -122,6 +122,19 @@ def entry_is_aal2(assurance) -> bool:
and assurance.get("mfa") is True)
def entry_failure(entry: dict, allowed: set, executor_identity: str) -> str | None:
"""The first check an approval entry fails, as a fixed name, or None. Never the subject itself."""
if entry.get("subject_id") not in allowed:
return "approver_not_listed"
if str(entry.get("principal_type", "")).lower() != "human":
return "not_human"
if not entry_is_aal2(entry.get("assurance")):
return "not_aal2"
if entry.get("subject_id") == executor_identity:
return "self_approval"
return None
def iso(t: dt.datetime) -> str:
return t.astimezone(dt.UTC).isoformat(timespec="seconds").replace("+00:00", "Z")
@ -192,10 +205,9 @@ class Run:
if not entries:
raise Refused("approval_no_entries")
for entry in entries: # aal2 is recorded, not enforced, by approval-engine today: check every entry
if (entry.get("subject_id") not in allowed or str(entry.get("principal_type", "")).lower() != "human"
or not entry_is_aal2(entry.get("assurance"))
or entry.get("subject_id") == self.cfg.executor_identity):
raise Refused("approval_entry")
failed = entry_failure(entry, allowed, self.cfg.executor_identity)
if failed: # names the first failed field, value-free (NK-WP-0058-T03; 2026-11-04 needed a diagnostic pod)
raise Refused("approval_entry:" + failed)
self.approver_subject = entries[0]["subject_id"]
window_end = bea.parse_time(spec["window"]["not_after"])
expires = (approval.get("validity") or {}).get("expires_at")