coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Preserve writable OIDC fields on the loopback callback update.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 3s
Details

Browse source 
The second attended attempt spawned the owner command, then failed closed.
Stop posting the entire role read-back and requiring exact dict equality.
Write a metadata receipt so the next failure has a class, not silence.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 02:23:22 +02:00
parent 7496d9fab5
commit 041f6bdc51
4 changed files with 185 additions and 27 deletions
Download patch file Download diff file Expand all files Collapse all files

10
docs/openbao-public-listener-transition.md
View file

@ -37,10 +37,16 @@ silent and Warden self-revokes the attended session:
warden plan \
"attended OpenBao platform administration to add the exact operator-tunneled OIDC callback to auth/netkingdom/role/platform-admin" \
--json
python3 scripts/openbao-attended-exec.py -- \
/home/worsch/railiance-platform/scripts/openbao-apply-operator-loopback-callback.sh
python3 /home/worsch/railiance-platform/scripts/openbao-attended-exec.py -- \
/home/worsch/railiance-platform/scripts/openbao-apply-operator-loopback-callback.sh \
--receipt /tmp/openbao-loopback-callback.json
```
The child stays silent. Metadata-only status lands in the receipt: `applied`,
`already_present`, or a failure class. Do not reuse a receipt path that already
exists. The helper writes only known OIDC role fields so a live read-back blob
cannot fail the update.
The plan must return `founder_required` and select
`openbao-platform-admin-login`. The owner command must be an absolute path:
Warden's contained child inherits the caller's cwd, so a relative `scripts/...`