coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Renew T03 requests using Railiance time and bind native execution
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-16 01:08:56 +02:00
parent 3bd3a2e87b
commit 5b3041cfb5
7 changed files with 219 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

12
scripts/t03-native-execution.py
View file

@ -6,6 +6,7 @@ from dataclasses import replace
import yaml
ROOT=Path('/home/worsch/secrets-engine')
sys.path.insert(0,str(ROOT/'src'))
sys.path.insert(0,'/home/worsch/railiance-clock/src')
from secrets_engine.config import Config
from secrets_engine.catalog import get_entry
from secrets_engine.authorization import build_action_request,digest_material
@ -15,10 +16,10 @@ from secrets_engine.decisions import resolve_decision,require_approved
from secrets_engine.openbao import OpenBaoClient
from secrets_engine.exec_owner import validate_delivery_target
from secrets_engine.plan import build_plan
RECEIPT=ROOT/'docs/evidence/2026-09-14-t03-native-execution.json'
RECEIPT=ROOT/'docs/evidence/2026-09-15-t03-native-execution.json'
KUBE=['kubectl','--kubeconfig','/home/worsch/.kube/config-railiance01']
ROLE='se-prod-openrouter-llm-connect'; LANE='openrouter-llm-connect'
IDS={'apply':'09592588-ab15-53e7-89b8-c4e9f29aaacf','verify':'9416fa31-fa9e-5603-8289-f35bc9625409','exec':'da678b61-35be-598e-8d95-a7aefa2fdc73'}
IDS={'apply':'9935335c-8e9a-566e-a48e-6a5b5f4882eb','verify':'273d6882-6253-5dc9-ac54-544f92ef5e56','exec':'7ba0c13b-68cd-5b3e-9481-42ba9e385e68'}
def require(value,code):
if not value:raise ValueError(code)
@ -34,7 +35,7 @@ def prepare(directory):
for action,approval in IDS.items():
folder=directory/action;folder.mkdir();doc=copy.deepcopy(source);doc['approval']['authorization_id']=approval
(folder/(LANE+'.yaml')).write_text(yaml.safe_dump(doc,sort_keys=False))
cfg=replace(Config.load(),catalog_dir=folder,bao_addr='https://bao.coulomb.social',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller')
cfg=replace(Config.load(),catalog_dir=folder,bao_addr='http://127.0.0.1:18200',approval_url='http://127.0.0.1:18281',approval_token_file=None,approval_client_secret_file=directory/'client-secret',keycape_token_url='https://kc.coulomb.social/token',keycape_issuer='https://kc.coulomb.social',keycape_client_secret_file=None,openbao_jwt_login_file=None,authorization_subject_id='secrets-engine',authorization_subject_type='service',authorization_policy_package='secrets-engine.catalog-lane.lifecycle',authorization_policy_version='v2',authorization_min_approvals=1,pdp_url='http://127.0.0.1:18282',pdp_token_file=directory/'pdp-caller')
entry=get_entry(folder,LANE);fields=() if action=='apply' else tuple(entry.fields)
actual=build_action_request(entry,action,subject_id='secrets-engine',subject_type='service',purpose=entry.approval['purpose'],fields=fields,policy_targets=(entry.policy_name,),auth_targets=(entry.role_name,))
expected=json.loads((ROOT/f'docs/evidence/2026-09-14-openrouter-final-{action}-request.json').read_text())
@ -73,6 +74,9 @@ def admin(directory,negative):
require('platform-admin' in policies and 'root' not in policies and identity.get('entity_id') and 0<identity['ttl']<=3600,'attended_operator_required')
require(bao('read','-format=json','sys/auth')['data'].get('approle/') is not None,'existing_approle_mount_required')
configs,entries,command=prepare(directory)
from secrets_engine.application_time import read_window
require(all(cfg.clock_trust_file for cfg in configs.values()),'admitted_railiance_clock_required')
for cfg in configs.values():read_window(cfg)
receipt['health_before']=health()
for ns,label,image,port in [('approval-engine','approval-engine','251941a5cb2724b57cc32cff6b693b1ab0be695bee4f56f02d51961189c0fa49',18281),('flex-auth','flex-auth-secrets-engine','05a03a8790c2210c48ea92391441c77ddf640d0cd32f5ec09838f5393171fcbd',18282)]:
pods=json.loads(run(*KUBE,'-n',ns,'get','pods','-l','app.kubernetes.io/name='+label,'-o','json'))['items']
@ -93,7 +97,7 @@ def admin(directory,negative):
auth=authorize_action(configs[action],entries[action],action,fields=() if action=='apply' else tuple(entries[action].fields),policy_targets=(ROLE,),auth_targets=(ROLE,))
require(auth is not None,'native_authorization_missing')
receipt['phase']='all_claims_and_pdp_checks_passed';save(receipt)
client=OpenBaoClient.resolve('https://bao.coulomb.social')
client=OpenBaoClient.resolve('http://127.0.0.1:18200')
existing=client.read_policy(ROLE)
require(existing is None and not client.approle_exists(ROLE),'existing_native_objects_require_reconciliation')
for action in IDS: