coulomb/railiance-platform
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Implement attended Railiance Clock host key delivery
All checks were successful
CI Smoke / host-smoke (push) Successful in 0s
Details
CI Smoke / container-smoke (push) Successful in 2s
Details

Browse source 
Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a09cbb-87c6-7900-a145-4ce53ba9f1a6
This commit is contained in:
codex 2026-09-15 23:00:20 +02:00
parent 3b11773469
commit e70ef2f32a
7 changed files with 284 additions and 49 deletions
Download patch file Download diff file Expand all files Collapse all files

14
scripts/credential-change.py
View file

@ -464,10 +464,16 @@ def validate_ccr(path: Path) -> tuple[dict[str, Any], list[str], list[str]]:
if isinstance(status, str) and status not in ALLOWED_STATUSES:
errors.append(f"status must be one of {sorted(ALLOWED_STATUSES)}")
request_type = ccr.get("request_type")
if request_type != "workload-kv-read":
errors.append("request_type must be workload-kv-read")
else:
if request_type == "workload-kv-read":
validate_workload_kv_read(ccr, errors, warnings)
elif request_type == "attended-host-key-delivery":
import importlib.util
spec = importlib.util.spec_from_file_location("railiance_clock_custody", REPO_DIR / "scripts/railiance_clock_custody.py")
owner = importlib.util.module_from_spec(spec)
spec.loader.exec_module(owner)
errors.extend(owner.validate_contract(ccr))
else:
errors.append("unsupported request_type")
return ccr, errors, warnings
@ -554,6 +560,8 @@ def render_summary(ccr: dict[str, Any], warnings: list[str]) -> str:
def generated_policy_hcl(ccr: dict[str, Any]) -> str:
if ccr.get("request_type") != "workload-kv-read":
fail("attended host delivery uses its owner procedure; no workload policy")
openbao = ccr["openbao"]
mount = openbao["mount"]
suffix = openbao["kv_path"][len(mount) + 1 :]