coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

MASON-WP-0009-T04 done: live capability verification of the KeyCape secrets-engine-openbao lane

Browse source 
Value-free evidence under the read-only ops-mason-survey grant (revoked after
use). Adds T05 for live-token checks and the pointer route. Fixes
bao-session.sh grant misreporting an unreadable policy as absent.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
tegwick 2026-10-07 13:47:14 +02:00
parent dee5bac2c6
commit 6a602edafb
4 changed files with 229 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
scripts/bao-session.sh
View file

@ -83,11 +83,21 @@ cmd_grant() {
if [[ -z "$task" ]]; then
red "usage: $0 grant <task-name> e.g. 'operators-mount'"; exit 2
fi
if ! bao policy read "$GRANT_POLICY" >/dev/null 2>&1; then
red "policy $GRANT_POLICY does not exist yet."
echo "Create it first — see docs, or ask Claude to draft it. Refusing to"
echo "fall back to a broader policy: an unscoped grant is the thing this"
echo "script exists to avoid."
local probe_err
if ! probe_err="$(bao policy read "$GRANT_POLICY" 2>&1 >/dev/null)"; then
# Only bao's own "No policy named" means absent. A 403 or a missing
# token means your session cannot read it (expired, or not permitted),
# which says nothing about whether the policy exists.
if [[ "$probe_err" == *"No policy named"* ]]; then
red "policy $GRANT_POLICY does not exist yet."
echo "Create it first — see docs, or ask Claude to draft it. Refusing to"
echo "fall back to a broader policy: an unscoped grant is the thing this"
echo "script exists to avoid."
else
red "cannot read policy $GRANT_POLICY (session expired or not permitted)."
echo "Check '$0 status'; refresh with '$0 login' and retry. This is not"
echo "evidence that the policy is missing."
fi
exit 1
fi
umask 077