coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0055 (proposed) and request type attended-service-credential-delivery
All checks were successful
CCR intake gate / gate (push) Successful in 9s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
A value held in platform custody that no workload reads, delivered into a
service by an attended, MFA-gated procedure (privacyIDEA resolver bind for
NetKingdom NK-WP-0056-T04). The contract forbids any policy, auth role, ESO
object or runtime frontdoor. Modelled on attended-host-key-delivery. 4 tests.
The 3 failures in test_credential_change.py also occur on main.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 896183@bnt-lap001
Assistant-Session: 3a18c01a-3205-4d02-94db-9efff25649a2
This commit is contained in:
codex 2026-10-31 11:03:44 +01:00
parent 674a7132d0
commit 2d4a3838bf
5 changed files with 235 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

17
scripts/credential-change.py
View file

@ -518,6 +518,8 @@ def validate_ccr(path: Path) -> tuple[dict[str, Any], list[str], list[str]]:
owner = importlib.util.module_from_spec(spec)
spec.loader.exec_module(owner)
errors.extend(owner.validate_contract(ccr))
elif request_type == "attended-service-credential-delivery":
errors.extend(attended_service_module().validate_contract(ccr))
elif request_type in LANE_MODULES:
errors.extend(lane_module(ccr).validate(ccr, REPO_DIR))
else:
@ -724,6 +726,8 @@ def auth_payload(ccr: dict[str, Any]) -> dict[str, Any]:
def render_plan(ccr: dict[str, Any]) -> str:
if ccr.get("request_type") == "attended-host-key-delivery":
return "Use docs/credential-lane-designs/railiance-clock-host-delivery.md through the attended owner procedure. No workload policy or auth role is created."
if ccr.get("request_type") == "attended-service-credential-delivery":
return attended_service_module().procedure_note(ccr)
openbao = ccr["openbao"]
auth = openbao["auth"]
payload = auth_payload(ccr)
@ -755,6 +759,8 @@ def render_plan(ccr: dict[str, Any]) -> str:
def render_operator_commands(ccr: dict[str, Any]) -> str:
if ccr.get("request_type") == "attended-host-key-delivery":
return "Use docs/credential-lane-designs/railiance-clock-host-delivery.md through the attended owner procedure. No workload policy or auth role is created."
if ccr.get("request_type") == "attended-service-credential-delivery":
return attended_service_module().procedure_note(ccr)
openbao = ccr["openbao"]
auth = openbao["auth"]
auth_path = f"auth/{auth['mount']}/role/{auth['role']}"
@ -835,6 +841,15 @@ LANE_MODULES = {
}
def attended_service_module():
"""Owner contract for attended-service-credential-delivery (no workload access)."""
import importlib.util
spec = importlib.util.spec_from_file_location("attended_service_delivery", REPO_DIR / "scripts/attended_service_delivery.py")
module = importlib.util.module_from_spec(spec)
spec.loader.exec_module(module)
return module
def lane_module(ccr: dict[str, Any]):
"""Lazy-load the applier module for a lane request type, or None."""
name = LANE_MODULES.get(ccr.get("request_type"))
@ -1115,6 +1130,8 @@ def render_applier_apply_plan(ccr: dict[str, Any], warnings: list[str]) -> str:
def runbook_readiness_blockers(ccr: dict[str, Any]) -> list[str]:
if ccr.get("request_type") == "attended-host-key-delivery":
return ["use the attended owner procedure in docs/credential-lane-designs/railiance-clock-host-delivery.md"]
if ccr.get("request_type") == "attended-service-credential-delivery":
return ["use the attended procedure: " + attended_service_module().procedure_note(ccr)]
blockers: list[str] = []
status = ccr.get("status")
if status not in RUNBOOK_ALLOWED_STATUSES: