coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Record verified production Clock custody and authority acceptance
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 23:13:13 +02:00
parent e70ef2f32a
commit 3bd3a2e87b
5 changed files with 102 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

16
scripts/credential-change.py
View file

@ -493,7 +493,7 @@ def render_summary(ccr: dict[str, Any], warnings: list[str]) -> str:
f" {openbao['kv_path']}",
f" {fields}",
"Policy:",
f" {openbao['policy_name']}",
f" {openbao.get('policy_name', 'none (attended host delivery)')}",
"Auth binding:",
]
if auth.get("method") == "token":
@ -664,6 +664,8 @@ def auth_payload(ccr: dict[str, Any]) -> dict[str, Any]:
def render_plan(ccr: dict[str, Any]) -> str:
if ccr.get("request_type") == "attended-host-key-delivery":
return "Use docs/credential-lane-designs/railiance-clock-host-delivery.md through the attended owner procedure. No workload policy or auth role is created."
openbao = ccr["openbao"]
auth = openbao["auth"]
payload = auth_payload(ccr)
@ -693,6 +695,8 @@ def render_plan(ccr: dict[str, Any]) -> str:
def render_operator_commands(ccr: dict[str, Any]) -> str:
if ccr.get("request_type") == "attended-host-key-delivery":
return "Use docs/credential-lane-designs/railiance-clock-host-delivery.md through the attended owner procedure. No workload policy or auth role is created."
openbao = ccr["openbao"]
auth = openbao["auth"]
auth_path = f"auth/{auth['mount']}/role/{auth['role']}"
@ -898,7 +902,7 @@ def applier_dry_run_payload(ccr: dict[str, Any], warnings: list[str]) -> dict[st
{
"kind": "policy_write",
"openbao_path": f"sys/policies/acl/{openbao['policy_name']}",
"policy_name": openbao["policy_name"],
"policy_name": openbao.get("policy_name"),
"source": openbao["policy_file"],
"body": generated_policy_hcl(ccr).rstrip(),
},
@ -998,6 +1002,8 @@ def render_applier_apply_plan(ccr: dict[str, Any], warnings: list[str]) -> str:
def runbook_readiness_blockers(ccr: dict[str, Any]) -> list[str]:
if ccr.get("request_type") == "attended-host-key-delivery":
return ["use the attended owner procedure in docs/credential-lane-designs/railiance-clock-host-delivery.md"]
blockers: list[str] = []
status = ccr.get("status")
if status not in RUNBOOK_ALLOWED_STATUSES:
@ -1281,7 +1287,7 @@ def lifecycle_payload(ccr: dict[str, Any], action: str) -> dict[str, Any]:
"openbao": {
"secret_path": openbao["kv_path"],
"fields": openbao["fields"],
"policy_name": openbao["policy_name"],
"policy_name": openbao.get("policy_name"),
"auth_role_path": auth_role_path,
"disable_commands": disable_commands,
},
@ -1627,7 +1633,7 @@ def status_payload(ccr: dict[str, Any], warnings: list[str]) -> dict[str, Any]:
"mount": openbao["mount"],
"kv_path": openbao["kv_path"],
"fields": openbao["fields"],
"policy_name": openbao["policy_name"],
"policy_name": openbao.get("policy_name"),
"auth_mount": auth.get("mount"),
"auth_method": auth.get("method"),
"auth_role": auth.get("role"),
@ -1783,7 +1789,7 @@ def decision_template_context(ccr: dict[str, Any]) -> dict[str, str]:
return {
"id": ccr["id"],
"kv_path": openbao["kv_path"],
"policy_name": openbao["policy_name"],
"policy_name": openbao.get("policy_name"),
"auth_role_path": f"auth/{auth['mount']}/role/{auth['role']}",
"decision_link": state_hub.get("decision_api_url")
or state_hub.get("decision_dashboard_url")