coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(RAILIANCE-WP-0027): prepare operator-only OpenBao access
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-5.6-sol
Assistant-Session: 01a02b90-83bf-75c2-81c8-aa705414e4d4
This commit is contained in:
codex 2026-08-23 12:50:23 +02:00
parent 082c76979e
commit 517f68593d
13 changed files with 413 additions and 82 deletions
Download patch file Download diff file Expand all files Collapse all files

23
workplans/RAILIANCE-WP-0026-attended-login-output-containment.md
View file

@ -4,7 +4,7 @@ type: workplan
title: "Contain attended OpenBao login output before authentication"
domain: financials
repo: railiance-platform
status: ready
status: finished
owner: codex
topic_slug: railiance
created: "2026-08-23"
@ -50,7 +50,7 @@ seal/unseal ceremony, or reuse of the terminal drill scenario.
```task
id: RAILIANCE-WP-0026-T01
status: todo
status: done
priority: high
```
@ -90,10 +90,19 @@ both reviewers, and `railiance-platform` accepts the exact revision. Completion
of this task still does not authorize a live drill; that requires fresh owner
receipts, current preflight, and a new human decision under a new scenario id.
Completed 2026-08-23. Railiance Platform accepts ops-warden revision
`0fae0904ce8d8694338dd53a8a79abec5fec788d`. The committed owner receipt at
ops-warden revision `bc1966da825fbeaa4d83947a4f942b5d5f085408` has SHA-256
`d2ba444ed16989590325697e69d25283dc75a9432c29a72e627e80bf9fd987e4`,
reports 42 focused tests and 390 repository tests passing, and records all
seven containment outcomes without sensitive material. Independent
railiance-infra review at revision `186b030` approves the same implementation.
This is source acceptance only and authorizes no live OIDC or drill.
## Acceptance
- [ ] The adapter refuses unsafe storage before OIDC.
- [ ] No underlying login output can reach the agent transcript.
- [ ] Any issued credential is contained and revoked on failure.
- [ ] Focused success and failure-path tests pass without credential material.
- [ ] Both direct reviewers receive and accept the value-safe fix receipt.
- [x] The adapter refuses unsafe storage before OIDC.
- [x] No underlying login output can reach the agent transcript.
- [x] Any issued credential is contained and revoked on failure.
- [x] Focused success and failure-path tests pass without credential material.
- [x] Both direct reviewers receive and accept the value-safe fix receipt.