From 6c9b4500436f1dd69403b1b4417595662e768742 Mon Sep 17 00:00:00 2001
From: tegwick <bernd.worsch@gmail.com>
Date: Fri, 9 Oct 2026 11:41:31 +0200
Subject: [PATCH] custody-describe apply: receipt under the real home, default
 BAO_ADDR

The warden wrapper runs with a temporary HOME and without BAO_ADDR, so the
second founder run exited non-zero and its receipt vanished with the
temporary directory. Failures now record bao's exit code in the receipt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
---
 scripts/custody-describe.py    | 13 +++++++++----
 tests/test_custody_describe.py | 10 ++++++++++
 2 files changed, 19 insertions(+), 4 deletions(-)

diff --git a/scripts/custody-describe.py b/scripts/custody-describe.py
index ea1cff3..9274771 100755
--- a/scripts/custody-describe.py
+++ b/scripts/custody-describe.py
@@ -121,7 +121,10 @@ def check(doc: dict) -> int:
     return 0 if bad == 0 else 1
 
 
-RECEIPT = os.path.join(HOME, ".local/state/railiance/receipts/custody-describe.json")
+# The warden wrapper runs with a temporary HOME, so resolve the real one.
+import pwd
+REAL_HOME = pwd.getpwuid(os.getuid()).pw_dir
+RECEIPT = os.path.join(REAL_HOME, ".local/state/railiance/receipts/custody-describe.json")
 
 
 def apply(doc: dict, receipt: str = RECEIPT) -> int:
@@ -136,8 +139,10 @@ def apply(doc: dict, receipt: str = RECEIPT) -> int:
         args = ["bao", "kv", "metadata", "patch", f"-mount={mount}"]
         args += [f"-custom-metadata={k}={_clip(e[k])}" for k in REQUIRED]
         args.append(rest)
-        ok = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
-        results[path] = "patched" if ok else "failed"
+        env = dict(os.environ)
+        env.setdefault("BAO_ADDR", "http://127.0.0.1:18200")
+        rc = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, env=env).returncode
+        results[path] = "patched" if rc == 0 else f"failed rc={rc}"
     os.makedirs(os.path.dirname(receipt), mode=0o700, exist_ok=True)
     old_umask = os.umask(0o077)
     try:
@@ -145,7 +150,7 @@ def apply(doc: dict, receipt: str = RECEIPT) -> int:
             json.dump(results, f, indent=1, sort_keys=True)
     finally:
         os.umask(old_umask)
-    return 1 if "failed" in results.values() else 0
+    return 1 if any(v.startswith("failed") for v in results.values()) else 0
 
 
 def main(argv: list[str]) -> int:
diff --git a/tests/test_custody_describe.py b/tests/test_custody_describe.py
index 220cae8..d7a9cc9 100644
--- a/tests/test_custody_describe.py
+++ b/tests/test_custody_describe.py
@@ -49,3 +49,13 @@ def test_check_refuses_drafts_missing_and_overlong_fields():
 
 def test_clip_respects_openbao_value_limit():
     assert len(cd._clip("y" * 2000)) == cd.MAX_VALUE
+
+
+def test_receipt_ignores_temporary_home_and_bao_addr_defaults(tmp_path, monkeypatch):
+    import pwd, os
+    assert cd.RECEIPT.startswith(pwd.getpwuid(os.getuid()).pw_dir)
+    monkeypatch.delenv("BAO_ADDR", raising=False)
+    doc = {"platform/workloads/a/b": {"review": "accepted", **FULL}}
+    with patch.object(cd.subprocess, "run", return_value=MagicMock(returncode=0)) as run:
+        cd.apply(doc, receipt=str(tmp_path / "r.json"))
+    assert run.call_args.kwargs["env"]["BAO_ADDR"] == "http://127.0.0.1:18200"