coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Silence applier-apply under --quiet and drop the retired bao callback default
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
The warden attended wrapper refuses any output, so --quiet now captures bao's
own messages and skips the [OK] lines; a failure reports only the step and exit
code. New OIDC scaffolds default to the operator-tunnel UI callback rather than
bao.coulomb.social, which was retired on 2026-09-15. Existing CCRs keep their
lists until amended. The CCR-2026-0033 test pins move to its approved/applied state.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 132360@bnt-lap001
Assistant-Session: 769b1afd-4330-4c86-96b2-e510e26db42b
This commit is contained in:
codex 2026-10-07 09:16:58 +02:00
parent 614d70fb8a
commit 720277bd39
3 changed files with 50 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

22
scripts/credential-change.py
View file

@ -1182,7 +1182,7 @@ def render_runbook(payload: dict[str, Any]) -> str:
return "\n".join(lines)
def run_bao_metadata_apply(ccr: dict[str, Any], bao_bin: str) -> None:
def run_bao_metadata_apply(ccr: dict[str, Any], bao_bin: str, quiet: bool = False) -> None:
openbao = ccr["openbao"]
auth = openbao["auth"]
auth_path = f"auth/{auth['mount']}/role/{auth['role']}"
@ -1196,7 +1196,14 @@ def run_bao_metadata_apply(ccr: dict[str, Any], bao_bin: str) -> None:
[bao_bin, "write", auth_path, f"@{role_path}"],
]
for command in commands:
subprocess.run(command, cwd=REPO_DIR, check=True)
if not quiet:
subprocess.run(command, cwd=REPO_DIR, check=True)
continue
# Silent mode for attended wrappers that refuse any output. bao's own
# messages are discarded; a failure reports only the step and exit code.
result = subprocess.run(command, cwd=REPO_DIR, capture_output=True)
if result.returncode != 0:
fail(f"bao {command[1]} failed with exit code {result.returncode}")
finally:
try:
role_path.unlink()
@ -1494,7 +1501,8 @@ def inventory_ccr_from_args(args: argparse.Namespace) -> dict[str, Any]:
allowed_redirect_uris = list(getattr(args, "redirect_uri", None) or [])
if args.auth_method == "oidc" and not allowed_redirect_uris:
allowed_redirect_uris = [
"https://bao.coulomb.social/ui/vault/auth/netkingdom/oidc/callback",
# bao.coulomb.social was retired on 2026-09-15; the UI goes through the operator tunnel.
"http://127.0.0.1:18200/ui/vault/auth/netkingdom/oidc/callback",
"http://localhost:8250/oidc/callback",
"http://127.0.0.1:8250/oidc/callback",
]
@ -2053,7 +2061,7 @@ def command_applier_apply(args: argparse.Namespace) -> int:
phrase = args.confirm or input("Type delegated apply confirmation phrase: ")
if phrase != expected:
fail(f"confirmation phrase mismatch; expected {expected!r}")
run_bao_metadata_apply(ccr, args.bao_bin)
run_bao_metadata_apply(ccr, args.bao_bin, quiet=args.quiet)
set_status = "applied" if ccr.get("status") == "approved" else None
details = delegated_apply_details(ccr, args.actor)
ccr = append_evidence(
@ -2064,7 +2072,8 @@ def command_applier_apply(args: argparse.Namespace) -> int:
details,
set_status=set_status,
)
print(f"[OK] {path.name} delegated metadata apply recorded")
if not args.quiet:
print(f"[OK] {path.name} delegated metadata apply recorded")
if args.record_state_hub:
event = record_evidence_state_hub(
ccr,
@ -2074,7 +2083,8 @@ def command_applier_apply(args: argparse.Namespace) -> int:
"passed",
details,
)
print(f"[OK] State Hub progress event {event.get('id', '<unknown>')}")
if not args.quiet:
print(f"[OK] State Hub progress event {event.get('id', '<unknown>')}")
return 0