coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: preserve unrelated live boundary rules during signing lane apply
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a06ed7-828d-7ca0-a8d4-0c3e5a0c4102
This commit is contained in:
codex 2026-09-05 16:43:47 +02:00
parent 80793afe4f
commit 238d261536
4 changed files with 24 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/state_hub_preflight_lane.py
View file

@ -167,12 +167,14 @@ def run(args, receipt):
if args.expected_version != 0:
raise LaneError('bootstrap_requires_cas_zero')
# Refuse drift rather than overwriting another operator's policy.
boundary = ROOT / 'openbao/policies/agent-high-risk-boundary.hcl'
overlay = (ROOT / 'openbao/state-hub-preflight/agent-deny-overlay.hcl').read_text()
current = data(bao(['read', '-format=json', 'sys/policies/acl/agent-high-risk-boundary']))['data']['policy']
baseline = (ROOT / 'openbao/policies/inputs/state-hub-preflight-boundary-baseline.sha256').read_text().strip()
if current != boundary.read_text() and hashlib.sha256(current.encode()).hexdigest() != baseline:
if hashlib.sha256(current.encode()).hexdigest() != baseline:
raise LaneError('boundary_policy_drift')
bao(['write', 'sys/policies/acl/agent-high-risk-boundary', '-'], payload={'policy': boundary.read_text()})
# Preserve live unrelated policy verbatim; add only the reviewed lane.
bao(['write', 'sys/policies/acl/agent-high-risk-boundary', '-'],
payload={'policy': current + '\n' + overlay})
existing = bao(['read', '-format=json', 'auth/kubernetes/role/' + ROLE], allow_failure=True)
if existing.returncode == 0:
raise LaneError('role_already_exists_review_partial_apply')