coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

custody-describe apply: silent, results to a 0600 receipt

Browse source 
The warden admin wrapper refuses any output; the first founder run was
refused (nothing written, all entries still drafts).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 11:22:46 +02:00
parent 6f529413c8
commit 7d54d049c1
3 changed files with 33 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

25
scripts/custody-describe.py
View file

@ -12,7 +12,7 @@ because a confidently wrong `used_by` is worse than an empty one.
`apply` writes custom_metadata only (`bao kv metadata patch`), for entries
marked `review: accepted` with all five fields filled. It never reads or writes
a value, prints nothing but paths and booleans, and runs under the founder's
a value, prints nothing (results go to a 0600 receipt), and runs under the founder's
admin session (warden access openbao-platform-admin-login --exec), since
ops-mason-survey cannot write metadata.
"""
@ -121,20 +121,31 @@ def check(doc: dict) -> int:
return 0 if bad == 0 else 1
def apply(doc: dict) -> int:
failed = 0
RECEIPT = os.path.join(HOME, ".local/state/railiance/receipts/custody-describe.json")
def apply(doc: dict, receipt: str = RECEIPT) -> int:
"""Silent: the warden wrapper refuses any output, so results go to a 0600 receipt."""
import json
results = {}
for path, e in doc.items():
if e.get("review") != "accepted" or any(not e.get(k) for k in REQUIRED):
print(f"skip {path}")
results[path] = "skipped"
continue
mount, rest = path.split("/", 1)
args = ["bao", "kv", "metadata", "patch", f"-mount={mount}"]
args += [f"-custom-metadata={k}={_clip(e[k])}" for k in REQUIRED]
args.append(rest)
ok = subprocess.run(args, stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL).returncode == 0
failed += not ok
print(f"{'patched' if ok else 'FAILED '} {path}")
return 1 if failed else 0
results[path] = "patched" if ok else "failed"
os.makedirs(os.path.dirname(receipt), mode=0o700, exist_ok=True)
old_umask = os.umask(0o077)
try:
with open(receipt, "w") as f:
json.dump(results, f, indent=1, sort_keys=True)
finally:
os.umask(old_umask)
return 1 if "failed" in results.values() else 0
def main(argv: list[str]) -> int: