custody-describe apply: record HTTP code, merge-put fallback when patch is refused

Third founder run: every write exited 2 (bao's generic error code), cause not
visible. The receipt now keeps only the HTTP status from stderr; on 403/405
for patch it reads metadata (never data), merges and writes it back whole,
preserving custom_metadata set by earlier CCRs.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0

scripts/custody-describe.py

@@ -127,22 +127,45 @@ REAL_HOME = pwd.getpwuid(os.getuid()).pw_dir
 RECEIPT = os.path.join(REAL_HOME, ".local/state/railiance/receipts/custody-describe.json")
 
 
+def _bao(args: list[str], env: dict) -> tuple[int, str, str]:
+    """Run bao; return (rc, stdout, http_code). stderr is reduced to its HTTP code."""
+    r = subprocess.run(["bao", *args], capture_output=True, text=True, env=env)
+    m = re.search(r"Code: (\d{3})", r.stderr or "")
+    return r.returncode, r.stdout, (m.group(1) if m else ("" if r.returncode == 0 else "no-code"))
+
+
+def _write(mount: str, rest: str, fields: dict, env: dict) -> str:
+    flags = [f"-custom-metadata={k}={_clip(v)}" for k, v in fields.items()]
+    rc, _, code = _bao(["kv", "metadata", "patch", f"-mount={mount}", *flags, rest], env)
+    if rc == 0:
+        return "patched"
+    if code not in ("403", "405"):
+        return f"failed patch http={code}"
+    # No patch capability: read metadata (never data), merge, write it back whole,
+    # so custom_metadata set by earlier CCRs survives.
+    import json
+    rc, out, code = _bao(["kv", "metadata", "get", "-format=json", f"-mount={mount}", rest], env)
+    if rc != 0:
+        return f"failed metadata-get http={code}"
+    current = ((json.loads(out or "{}").get("data") or {}).get("custom_metadata")) or {}
+    merged = {**current, **{k: _clip(v) for k, v in fields.items()}}
+    flags = [f"-custom-metadata={k}={v}" for k, v in merged.items()]
+    rc, _, code = _bao(["kv", "metadata", "put", f"-mount={mount}", *flags, rest], env)
+    return "merged" if rc == 0 else f"failed put http={code}"
+
+
 def apply(doc: dict, receipt: str = RECEIPT) -> int:
     """Silent: the warden wrapper refuses any output, so results go to a 0600 receipt."""
     import json
+    env = dict(os.environ)
+    env.setdefault("BAO_ADDR", "http://127.0.0.1:18200")
     results = {}
     for path, e in doc.items():
         if e.get("review") != "accepted" or any(not e.get(k) for k in REQUIRED):
             results[path] = "skipped"
             continue
         mount, rest = path.split("/", 1)
-        args = ["bao", "kv", "metadata", "patch", f"-mount={mount}"]
-        args += [f"-custom-metadata={k}={_clip(e[k])}" for k in REQUIRED]
-        args.append(rest)
-        env = dict(os.environ)
-        env.setdefault("BAO_ADDR", "http://127.0.0.1:18200")
-        rc = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=env).returncode
-        results[path] = "patched" if rc == 0 else f"failed rc={rc}"
+        results[path] = _write(mount, rest, {k: e[k] for k in REQUIRED}, env)
     os.makedirs(os.path.dirname(receipt), mode=0o700, exist_ok=True)
     old_umask = os.umask(0o077)
     try:

tests/test_custody_describe.py

@@ -1,4 +1,8 @@
 import importlib.util
+import json
+import os
+import pwd
+import stat
 from pathlib import Path
 from unittest.mock import patch, MagicMock
 
@@ -9,32 +13,47 @@ _spec.loader.exec_module(cd)
 FULL = dict(description="d", owner="o", used_by="u", rotation="r", on_loss="l")
 
 
-def test_apply_patches_only_accepted_complete_entries_and_only_metadata(tmp_path, capsys):
+def _r(rc=0, out="", err=""):
+    return MagicMock(returncode=rc, stdout=out, stderr=err)
+
+
+def test_apply_patches_only_accepted_complete_entries_silently(tmp_path, capsys):
     doc = {
         "platform/workloads/a/b": {"review": "accepted", **FULL},
         "platform/workloads/c/d": {"review": "draft", **FULL},
         "operators/e": {"review": "accepted", **dict(FULL, used_by="")},
     }
-    with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run:
-        assert cd.apply(doc, receipt=str(tmp_path / 'r.json')) == 0
-    assert capsys.readouterr() == ('', '')
-    import json, os, stat
-    r = tmp_path / 'r.json'
-    assert json.load(open(r)) == {'platform/workloads/a/b': 'patched', 'platform/workloads/c/d': 'skipped', 'operators/e': 'skipped'}
-    assert stat.S_IMODE(os.stat(r).st_mode) == 0o600
+    with patch.object(cd.subprocess, "run", return_value=_r()) as run:
+        assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 0
+    assert capsys.readouterr() == ("", "")
     assert run.call_count == 1
     args = run.call_args.args[0]
-    assert args[:5] == ["bao", "kv", "metadata", "patch", "-mount=platform"]
-    assert args[-1] == "workloads/a/b"
-    assert not any(a in ("get", "put", "patch-data") or "/data/" in a for a in args)
-    assert run.call_args.kwargs["stdout"] is cd.subprocess.DEVNULL and run.call_args.kwargs["stderr"] is cd.subprocess.DEVNULL
+    assert args[:5] == ["bao", "kv", "metadata", "patch", "-mount=platform"] and args[-1] == "workloads/a/b"
+    assert not any(a in ("get", "put") or "/data/" in a for a in args)
+    r = tmp_path / "r.json"
+    assert json.load(open(r)) == {"platform/workloads/a/b": "patched", "platform/workloads/c/d": "skipped", "operators/e": "skipped"}
+    assert stat.S_IMODE(os.stat(r).st_mode) == 0o600
 
 
-def test_apply_reports_failure_without_output(tmp_path, capsys):
+def test_patch_refused_falls_back_to_merge_keeping_existing_metadata(tmp_path):
+    existing = json.dumps({"data": {"custom_metadata": {"ccr": "CCR-2026-0033", "owner": "old"}}})
+    calls = [_r(2, err="Error ... Code: 403. Errors: permission denied"), _r(0, out=existing), _r(0)]
     doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}}
-    with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=2)):
-        assert cd.apply(doc, receipt=str(tmp_path / 'r.json')) == 1
-    assert capsys.readouterr() == ('', '')
+    with patch.object(cd.subprocess, "run", side_effect=calls) as run:
+        assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 0
+    get_args, put_args = run.call_args_list[1].args[0], run.call_args_list[2].args[0]
+    assert get_args[1:4] == ["kv", "metadata", "get"]
+    assert put_args[1:4] == ["kv", "metadata", "put"]
+    assert "-custom-metadata=ccr=CCR-2026-0033" in put_args and "-custom-metadata=owner=o" in put_args
+    assert json.load(open(tmp_path / "r.json")) == {"platform/workloads/a/b": "merged"}
+
+
+def test_failure_records_only_http_code(tmp_path, capsys):
+    doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}}
+    with patch.object(cd.subprocess, "run", return_value=_r(2, err="Code: 500. secret-ish detail")):
+        assert cd.apply(doc, receipt=str(tmp_path / "r.json")) == 1
+    assert capsys.readouterr() == ("", "")
+    assert json.load(open(tmp_path / "r.json")) == {"platform/workloads/a/b": "failed patch http=500"}
 
 
 def test_check_refuses_drafts_missing_and_overlong_fields():
@@ -52,10 +71,9 @@ def test_clip_respects_openbao_value_limit():
 
 
 def test_receipt_ignores_temporary_home_and_bao_addr_defaults(tmp_path, monkeypatch):
-    import pwd, os
     assert cd.RECEIPT.startswith(pwd.getpwuid(os.getuid()).pw_dir)
     monkeypatch.delenv("BAO_ADDR", raising=False)
     doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}}
-    with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run:
+    with patch.object(cd.subprocess, "run", return_value=_r()) as run:
         cd.apply(doc, receipt=str(tmp_path / "r.json"))
     assert run.call_args.kwargs["env"]["BAO_ADDR"] == "http://127.0.0.1:18200"