coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Run the custody session through a Make target, and give the runner a shebang
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The runner was executable with no shebang, so a shell handed its path tried to
interpret Python as shell script. That is what a broken command line hit, and it
would have hit anyone invoking the file directly.

Also adds `make openbao-open-questions`, which is short enough that terminal
wrapping cannot split it, refuses a receipt path that is missing or already
exists, and clears OPENBAO_TOKEN/VAULT_TOKEN/BAO_TOKEN before invoking the
attended envelope so the identity comes from the login rather than a standing
token.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WLUjpv3ssxNRAEPPgLFnEB

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1275505@bnt-lap001
Assistant-Session: 97265baa-f08f-4032-b290-a1e2965a69c5
This commit is contained in:
codex 2026-09-10 08:15:41 +02:00
parent 3109f950f9
commit 18f4ddec2b
3 changed files with 20 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

16
docs/openbao-open-questions-session.md
View file

@ -26,11 +26,14 @@ attended OIDC through `bao login -method=oidc -path=netkingdom role=platform-adm
The owner command is never run directly.
```sh
scripts/openbao-attended-exec.py -- \
/usr/bin/python3 /home/worsch/railiance-platform/scripts/openbao_open_questions_session.py \
--receipt /tmp/<new-unique-name>.json
make openbao-open-questions SESSION_RECEIPT=/tmp/<new-unique-name>.json
```
Use the Make target rather than typing the underlying command: it is short enough
not to be broken by terminal wrapping, it refuses a `SESSION_RECEIPT` that already
exists or is missing, and it clears any ambient token before invoking the
envelope.
`scripts/openbao-attended-exec.py` supplies the WSL browser launcher and then
`exec`s into `warden access openbao-platform-admin-login --exec`, so Warden keeps
the envelope: it captures both streams, owns the temporary token helper and
@ -42,15 +45,14 @@ The runner prints nothing. Its entire output is the receipt.
**To settle the npm field alone**, run only the two questions that bear on it:
```sh
scripts/openbao-attended-exec.py -- \
/usr/bin/python3 /home/worsch/railiance-platform/scripts/openbao_open_questions_session.py \
--questions Q1,Q2 --receipt /tmp/<new-unique-name>.json
make openbao-open-questions SESSION_QUESTIONS=Q1,Q2 SESSION_RECEIPT=/tmp/<new-unique-name>.json
```
`--questions` defaults to all five. Q5 is the only step that reads the backup
lane, so naming a subset is also how to exclude it.
**Ambient-token guard.** The runner refuses to start if `OPENBAO_TOKEN`,
**Ambient-token guard.** The Make target clears these before invoking the
envelope; the runner independently refuses to start if `OPENBAO_TOKEN`,
`BAO_TOKEN` or `VAULT_TOKEN` is set in the environment. A standing token would
let these reads succeed without the attended login, producing a receipt that
looks attended and is not. Unset it first; the envelope supplies the identity.