15184aaa01
ACTIVITY-WP-0039-T02. Add read on the two exact worker-token paths to workload-kv-read-activity-core-eso, one CCR per worker identity. Adds scripts/openbao-policy-sync.sh, a silent attended policy writer that refuses undeclared live drift and verifies on readback. Not applied; CCRs await platform-operator and activity-core-owner approval. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 150322@bnt-lap001 Assistant-Session: 16a7b788-374e-4915-a1df-fc87ffd9a5e4
4 lines
193 B
Bash
Executable file
4 lines
193 B
Bash
Executable file
#!/usr/bin/env bash
|
|
# Silent child for the governed attended login; results go to the receipt only.
|
|
set -euo pipefail
|
|
exec python3 "$(dirname "$0")/openbao_policy_sync.py" "$@" >/dev/null 2>&1
|