coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Let the session run the npm questions alone, and refuse an ambient token
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
--questions selects a subset, so the npm field can be settled with Q1,Q2 without
the two data reads the other questions imply; Q5 is the only step touching the
backup lane and is now excludable by name.

The runner also refuses to start when OPENBAO_TOKEN, BAO_TOKEN or VAULT_TOKEN is
set. A standing token would let every read succeed without the attended login and
produce a receipt that looks attended and is not. --allow-ambient-token overrides
and records attended_identity false rather than claiming provenance it does not
have.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
This commit is contained in:
codex 2026-09-10 08:06:30 +02:00
parent f3cf832a35
commit 07b6b63fe6
2 changed files with 120 additions and 69 deletions
Download patch file Download diff file Expand all files Collapse all files

19
docs/openbao-open-questions-session.md
View file

@ -39,6 +39,25 @@ the writer opens it `O_EXCL` at mode 0600 and refuses to overwrite.
The runner prints nothing. Its entire output is the receipt.
**To settle the npm field alone**, run only the two questions that bear on it:
```sh
scripts/openbao-attended-exec.py -- \
/usr/bin/python3 /home/worsch/railiance-platform/scripts/openbao_open_questions_session.py \
--questions Q1,Q2 --receipt /tmp/<new-unique-name>.json
```
`--questions` defaults to all five. Q5 is the only step that reads the backup
lane, so naming a subset is also how to exclude it.
**Ambient-token guard.** The runner refuses to start if `OPENBAO_TOKEN`,
`BAO_TOKEN` or `VAULT_TOKEN` is set in the environment. A standing token would
let these reads succeed without the attended login, producing a receipt that
looks attended and is not. Unset it first; the envelope supplies the identity.
`--allow-ambient-token` overrides, and then the receipt records
`attended_identity: false` — which is the honest label for that read, not a
formality.
## What the runner reads, and the one honest caveat
| Step | Call | Emitted |