coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

custody-describe apply: receipt under the real home, default BAO_ADDR

Browse source 
The warden wrapper runs with a temporary HOME and without BAO_ADDR, so the
second founder run exited non-zero and its receipt vanished with the
temporary directory. Failures now record bao's exit code in the receipt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 11:41:31 +02:00
parent c2b6bd5ef3
commit 6c9b450043
2 changed files with 19 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
scripts/custody-describe.py
View file

@ -121,7 +121,10 @@ def check(doc: dict) -> int:
return 0 if bad == 0 else 1
RECEIPT = os.path.join(HOME, ".local/state/railiance/receipts/custody-describe.json")
# The warden wrapper runs with a temporary HOME, so resolve the real one.
import pwd
REAL_HOME = pwd.getpwuid(os.getuid()).pw_dir
RECEIPT = os.path.join(REAL_HOME, ".local/state/railiance/receipts/custody-describe.json")
def apply(doc: dict, receipt: str = RECEIPT) -> int:
@ -136,8 +139,10 @@ def apply(doc: dict, receipt: str = RECEIPT) -> int:
args = ["bao", "kv", "metadata", "patch", f"-mount={mount}"]
args += [f"-custom-metadata={k}={_clip(e[k])}" for k in REQUIRED]
args.append(rest)
ok = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
results[path] = "patched" if ok else "failed"
env = dict(os.environ)
env.setdefault("BAO_ADDR", "http://127.0.0.1:18200")
rc = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=env).returncode
results[path] = "patched" if rc == 0 else f"failed rc={rc}"
os.makedirs(os.path.dirname(receipt), mode=0o700, exist_ok=True)
old_umask = os.umask(0o077)
try:
@ -145,7 +150,7 @@ def apply(doc: dict, receipt: str = RECEIPT) -> int:
json.dump(results, f, indent=1, sort_keys=True)
finally:
os.umask(old_umask)
return 1 if "failed" in results.values() else 0
return 1 if any(v.startswith("failed") for v in results.values()) else 0
def main(argv: list[str]) -> int:

10
tests/test_custody_describe.py
View file

@ -49,3 +49,13 @@ def test_check_refuses_drafts_missing_and_overlong_fields():
def test_clip_respects_openbao_value_limit():
assert len(cd._clip("y" * 2000)) == cd.MAX_VALUE
def test_receipt_ignores_temporary_home_and_bao_addr_defaults(tmp_path, monkeypatch):
import pwd, os
assert cd.RECEIPT.startswith(pwd.getpwuid(os.getuid()).pw_dir)
monkeypatch.delenv("BAO_ADDR", raising=False)
doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}}
with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run:
cd.apply(doc, receipt=str(tmp_path / "r.json"))
assert run.call_args.kwargs["env"]["BAO_ADDR"] == "http://127.0.0.1:18200"