coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Reconcile T03 verification and complete guarded native execution
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 6s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-16 02:12:45 +02:00
parent 5b3041cfb5
commit 9e658be8e3
5 changed files with 118 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

10
scripts/t03-attended-delivery.py
View file

@ -1,5 +1,5 @@
"""Scoped reader -> contained attended administration; never exports credentials."""
import importlib.util,json,os,signal,stat,subprocess,tempfile
import importlib.util,json,os,signal,stat,subprocess,tempfile,sys
from pathlib import Path
from datetime import datetime,timezone
from urllib.request import Request,build_opener,ProxyHandler,HTTPRedirectHandler
@ -13,9 +13,13 @@ def require(value,code):
if not value:raise ValueError(code)
def private(path,directory=False):
st=path.lstat();require(st.st_uid==os.getuid() and stat.S_IMODE(st.st_mode)==(0o700 if directory else 0o600) and (stat.S_ISDIR(st.st_mode) if directory else stat.S_ISREG(st.st_mode)),'private_path_required')
RESUME=sys.argv[1:]==['--resume-exec']
if sys.argv[1:] and not RESUME:raise SystemExit('unsupported mode')
if RESUME:RECEIPT=ROOT/'docs/evidence/2026-09-16-t03-resume-attended-delivery.json'
def main(receipt):
require(Path.home().parent.name=='.warden-attended-login' and not os.getenv('BAO_TOKEN') and not os.getenv('VAULT_TOKEN'),'attended_reader_required')
require(not Path('/home/worsch/secrets-engine/docs/evidence/2026-09-15-t03-native-execution.json').exists(),'execution_receipt_requires_reconciliation')
require(not Path('/home/worsch/secrets-engine/docs/evidence/'+('2026-09-16-t03-resume-exec.json' if RESUME else '2026-09-15-t03-native-execution.json')).exists(),'execution_receipt_requires_reconciliation')
identity=pre.bao('token','lookup','-format=json')['data'];pre.validate_identity(identity)
for path,expected in pre.EXPECTED.items():require(sorted(pre.bao('token','capabilities','-format=json',path))==expected,'reader_scope_failed')
runtime=Path('/run/user')/str(os.getuid());private(runtime,True)
@ -34,7 +38,7 @@ def main(receipt):
del value,data,req
receipt.update(phase='scoped_reader_delivered',reader_effective_policy_verified=True,existing_kv_version=1)
RECEIPT.write_text(json.dumps(receipt,indent=2)+'\n')
p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','/home/worsch/secrets-engine/.venv/bin/python','-B',str(ROOT/'scripts/t03-native-execution.py'),'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780)
p=subprocess.run(['python3',str(ROOT/'scripts/openbao-attended-exec.py'),'--','/home/worsch/secrets-engine/.venv/bin/python','-B',str(ROOT/'scripts/t03-native-execution.py'),'resume-exec' if RESUME else 'admin','--directory',str(directory),'--negative-token-file',str(helper)],capture_output=True,timeout=780)
# Warden's output remains inside this envelope, never forwarded or stored.
require(p.returncode==0,'attended_admin_failed')
receipt.update(status='passed',phase='native_actions_completed',admin_warden_exited_0=True)