coulomb/railiance-platform
5
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

CCR-2026-0058: drop required_parameters from the write policy; back to proposed for re-approval
All checks were successful
CCR intake gate / gate (push) Successful in 1m11s
Details
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 1s
Details

Browse source 
OpenBao 2.5.4 applies required_parameters to reads, so the executor could not
read the version it must name for CAS (net-kingdom NK-WP-0056-T12 synthetic
pilot). cas_required on the key still refuses writes without options.cas;
metadata, delete, sibling and new paths stay denied (tested). Renderer, test
and policy file corrected.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 994874@bnt-lap001
Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
This commit is contained in:
codex 2026-10-31 16:24:47 +01:00
parent 331c4af2bf
commit c20bf329fd
5 changed files with 19 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

7
scripts/workload_kv_write_next_version.py
View file

@ -34,12 +34,15 @@ DISALLOWED_POLICIES = {"root", "default", "platform-admin"}
def policy_hcl(ccr: dict[str, Any]) -> str:
"""Exact policy: read and update of one data path; no create, metadata, delete or list."""
"""Exact policy: read and update of one data path; no create, metadata, delete or list.
No required_parameters: OpenBao applies it to reads as well, so a GET (which carries no `options`) is
refused and the executor cannot learn the version it must name (NK-WP-0056-T12 synthetic pilot,
2026-10-31). The key's cas_required is what refuses a write without options.cas."""
openbao = ccr["openbao"]
suffix = openbao["kv_path"][len("platform/"):]
return (f'path "platform/data/{suffix}" {{\n'
' capabilities = ["read", "update"]\n'
' required_parameters = ["options"]\n'
' allowed_parameters = {\n "data" = []\n "options" = []\n }\n'
"}\n\n"
'path "auth/token/lookup-self" {\n capabilities = ["read"]\n}\n\n'