coulomb/ops-mason
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

WP-0005-T05: lane verified from policy and role; owner-run check script; Forgejo case plan rendered

Browse source 
Live policy and role equal the approved spec, 8 agent denies present, custody
at coulomb v1. verify-fluid-telegram-lane.sh lets the founder prove member
capabilities and non-member refusal without printing a token. T06 entry
proposed to ops-warden. plans/case-forgejo-netkingdom-oidc.md: reviewed,
no collisions.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 327203@bnt-lap001
Assistant-Session: 55028ae3-4914-4bd1-8f5c-815f3527aef0
This commit is contained in:
tegwick 2026-10-09 19:47:45 +02:00
parent e10bc2b82b
commit cd251f7c2e
4 changed files with 214 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

50
scripts/verify-fluid-telegram-lane.sh Executable file
View file

@ -0,0 +1,50 @@
#!/usr/bin/env bash
# MASON-WP-0005-T05 — operator-side proof of the fluid-telegram operator lane.
#
# ./scripts/verify-fluid-telegram-lane.sh member # sign in as a fluid-telegram-operators member (aal2)
# ./scripts/verify-fluid-telegram-lane.sh non-member # sign in as someone outside the group
#
# Logs in on the lane's OIDC role, asks OpenBao what the token may do on each
# path (sys/capabilities-self: names only, never a value), revokes the token,
# and writes a 0600 receipt. The token is held in a shell variable only: never
# printed, never stored in the token helper, so your own session is untouched.
# The login URL appears on stderr as usual; only the token goes to stdout.
set -euo pipefail
export BAO_ADDR="${BAO_ADDR:-http://127.0.0.1:18200}"
ROLE=fluid-telegram-hall-of-helix-workload-kv
BASE=platform/data/workloads/coulomb/fluid-telegram/hall-of-helix
RECEIPTS="$(getent passwd "$(id -u)" | cut -d: -f6)/.local/state/railiance/receipts"
mode="${1:-}"
case "$mode" in member|non-member) ;; *) echo "usage: $0 member|non-member" >&2; exit 2 ;; esac
umask 077
mkdir -p "$RECEIPTS"
receipt="$RECEIPTS/fluid-telegram-lane-$mode.txt"
echo "Sign in as the $mode identity in your browser (URL below)." >&2
if ! token="$(bao login -token-only -method=oidc -path=netkingdom role="$ROLE")" || [ -z "$token" ]; then
{ echo "mode=$mode at=$(date -u +%FT%TZ)"; echo "login=refused"; } > "$receipt"
echo "login refused (expected for non-member); receipt: $receipt" >&2
[ "$mode" = non-member ] && exit 0 || exit 1
fi
{
echo "mode=$mode at=$(date -u +%FT%TZ)"
echo "login=ok"
for p in \
"$BASE/operator-app" "$BASE/operator-session" "$BASE/bot-token" "$BASE/redaction-salt" \
"platform/data/workloads/coulomb/fluid-telegram/hall-of-helix" \
"platform/data/workloads/coulomb/fluid-telegram/other-campaign/bot-token" \
"platform/data/workloads/coulomb/whynot-design/npm-publish" \
"platform/metadata/workloads/coulomb/fluid-telegram/hall-of-helix/operator-session" \
"platform/data/workloads/keycape/secrets-engine-openbao" \
"sys/policies/acl/agent-high-risk-boundary"; do
echo "$p: $(BAO_TOKEN="$token" bao token capabilities "$p" 2>/dev/null || echo error)"
done
echo "policies=$(BAO_TOKEN="$token" bao token lookup -format=json 2>/dev/null | python3 -c 'import json,sys; print(",".join(json.load(sys.stdin)["data"]["policies"]))' || echo error)"
} > "$receipt"
BAO_TOKEN="$token" bao token revoke -self >/dev/null 2>&1 && echo "revoked=yes" >> "$receipt" || echo "revoked=FAILED" >> "$receipt"
unset token
echo "receipt: $receipt" >&2
[ "$mode" = member ]