coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Require an absolute owner command after attended OpenBao login.
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
A relative scripts path can fail to spawn after a successful contained
OIDC session, which Warden then revokes. The wrapper now resolves the
command first; T03 records that this attempt did not write the role.

Assistant: grok
Assistant-Session: 01a0a23b-3bf0-7341-b4e5-9dc05f72573a
This commit is contained in:
codex 2026-09-15 02:16:42 +02:00
parent bb1aa85aea
commit 7496d9fab5
5 changed files with 81 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

15
docs/evidence/2026-09-15-openbao-loopback-relative-path-handoff.json Normal file
View file

@ -0,0 +1,15 @@
{
"schema": "railiance-platform.attended-login-attempt.v1",
"observed_at": "2026-09-15T00:11:57Z",
"lane_id": "openbao-platform-admin-login",
"plan_verdict": "founder_required",
"login_helper_reached": true,
"owner_command_started": false,
"warden_message": "attended command could not start; the login session was revoked",
"session_revoked": true,
"role_mutated": false,
"ingress_mutated": false,
"credential_values_emitted": false,
"cause": "relative owner command path failed to spawn after successful contained login",
"retry": "python3 scripts/openbao-attended-exec.py -- /home/worsch/railiance-platform/scripts/openbao-apply-operator-loopback-callback.sh"
}

12
docs/openbao-public-listener-transition.md
View file

@ -37,13 +37,17 @@ silent and Warden self-revokes the attended session:
warden plan \
"attended OpenBao platform administration to add the exact operator-tunneled OIDC callback to auth/netkingdom/role/platform-admin" \
--json
warden access openbao-platform-admin-login --exec -- \
scripts/openbao-apply-operator-loopback-callback.sh
python3 scripts/openbao-attended-exec.py -- \
/home/worsch/railiance-platform/scripts/openbao-apply-operator-loopback-callback.sh
```
The plan must return `founder_required` and select
`openbao-platform-admin-login`. Do not run the owner command directly with a
persistent token.
`openbao-platform-admin-login`. The owner command must be an absolute path:
Warden's contained child inherits the caller's cwd, so a relative `scripts/...`
path raises OSError, prints `attended command could not start`, and revokes a
successful login without applying the callback. Do not run the owner command
directly with a persistent token. The wrapper also supplies the WSL browser
launcher when native `xdg-open` is absent.
## Guarded sequence