coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Renew T03 requests using Railiance time and bind native execution
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-16 01:08:56 +02:00
parent 3bd3a2e87b
commit 5b3041cfb5
7 changed files with 219 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

8
scripts/t03-attended-delivery.py
View file

@ -5,7 +5,7 @@ from datetime import datetime,timezone
from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
ROOT=Path('/home/worsch/railiance-platform')
spec=importlib.util.spec_from_file_location('preflight',ROOT/'scripts/approval-client-reader-preflight.py');pre=importlib.util.module_from_spec(spec);spec.loader.exec_module(pre)
RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-attended-delivery.json'
RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-attended-delivery.json'
class NoRedirect(HTTPRedirectHandler):
def redirect_request(self,*args,**kwargs):return None
@ -15,7 +15,7 @@ def private(path,directory=False):
st=path.lstat();require(st.st_uid==os.getuid() and stat.S_IMODE(st.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(st.st_mode) if directory else stat.S_ISREG(st.st_mode)),'private_path_required')
def main(receipt):
require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_reader_required')
require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-14-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation')
require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-15-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation')
identity=pre.bao('token','lookup','-format=json')['data'];pre.validate_identity(identity)
for path,expected in pre.EXPECTED.items():require(sorted(pre.bao('token','capabilities','-format=json',path))==expected,'reader_scope_failed')
runtime=Path('/run/user')/str(os.getuid());private(runtime,True)
@ -24,7 +24,7 @@ def main(receipt):
helper=Path.home()/'.vault-token';private(helper)
with tempfile.TemporaryDirectory(prefix='t03-native-',dir=runtime) as name:
directory=Path(name);private(directory,True)
req=Request('https://bao.coulomb.social/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':helper.read_text().strip()})
req=Request('http://127.0.0.1:18200/v1/platform/data/workloads/secrets-engine/approval-client?version=1',headers={'X-Vault-Token':helper.read_text().strip()})
with build_opener(ProxyHandler({}),NoRedirect()).open(req,timeout=20) as response:
data=response.read(65537);require(len(data)<=65536,'response_bound_exceeded')
data=json.loads(data);require(data['data']['metadata']['version']==1,'custody_version_mismatch')
@ -34,7 +34,7 @@ def main(receipt):
del value,data,req
receipt.update(phase='scoped_reader_delivered',reader_effective_policy_verified=True,existing_kv_version=1)
RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','python3','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780)
p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','/home/worsch/secrets-engine/.venv/bin/python','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780)
# Warden's output remains inside this envelope, never forwarded or stored.
require(p.returncode==0,'attended_admin_failed')
receipt.update(status='passed',phase='native_actions_completed',admin_warden_exited_0=True)