railiance-platform/scripts/apply-reuse-surface-reader-custody.py

#!/usr/bin/env python3
"""Silent attended exact-policy update and existing reviewed reader bootstrap.

Unlike generic CCR metadata apply, this command NEVER writes the reused ESO role.
Installed role drift and differing ACL stop before mutations. --preflight reads
only role/ACL metadata; it does not request Forgejo credentials. --execute needs
approved CCR plus exact bootstrap and runner artifact receipts. Outer sanctioned
OpenBao login owns identity, browser, helper containment and self-revocation.
"""
import argparse
import hashlib
import importlib.util
import json
import os
import tempfile
from pathlib import Path
import subprocess
import sys
import yaml

ROOT=Path(__file__).resolve().parent.parent
SCRIPT='scripts/apply-reuse-surface-reader-custody.py'
CANDIDATE_FILE='docs/proposals/2026-10-15-reuse-private-reader/conditional-approved-ccr-state-candidate-r1.json'
POLICY_FILE='openbao/policies/workload-kv-read-reuse-surface-runtime-eso.hcl'
POLICY='workload-kv-read-reuse-surface-runtime-eso'
ROLE='auth/kubernetes/role/reuse-surface-runtime-eso'
BASELINE='''path "platform/data/workloads/reuse/reuse-surface/runtime-secrets" {
  capabilities = ["read"]
}

path "auth/token/lookup-self" {
  capabilities = ["read"]
}

path "auth/token/revoke-self" {
  capabilities = ["update"]
}
'''
spec=importlib.util.spec_from_file_location('reuse_reader_bootstrap',ROOT/'scripts/provision-reuse-surface-forgejo-source.py')
p=importlib.util.module_from_spec(spec);spec.loader.exec_module(p)


def validate_role(data):
    expected={'bound_service_account_names':['reuse-surface-eso'],'bound_service_account_namespaces':['reuse'],
              'audience':'openbao','token_ttl':900,'token_max_ttl':900,'token_explicit_max_ttl':900,
              'token_no_default_policy':True,'token_policies':[POLICY]}
    if not isinstance(data,dict) or any(data.get(k)!=v for k,v in expected.items()):
        raise p.Refused('installed_eso_role_drift')
    if 'policies' in data and data['policies']!=[POLICY]:
        raise p.Refused('installed_eso_role_drift')
    if data.get('token_period',0)!=0 or data.get('token_bound_cidrs',[]) or data.get('bound_service_account_namespace_selector',''):
        raise p.Refused('installed_eso_role_drift')


def read_policy():
    result=p.Bao.run(['policy','read',POLICY])
    if result.returncode!=0:
        raise p.Refused('policy_read_failed')
    try:
        return result.stdout.decode().strip()
    except Exception:
        raise p.Refused('policy_invalid_encoding') from None


def preflight(journal, desired_text=None):
    result=p.Bao.run(['read','-format=json',ROLE])
    if result.returncode!=0:
        raise p.Refused('installed_eso_role_read_failed')
    try:
        data=json.loads(result.stdout)['data']
    except Exception:
        raise p.Refused('installed_eso_role_invalid') from None
    validate_role(data)
    desired=(ROOT/POLICY_FILE).read_text().strip() if desired_text is None else desired_text
    current=read_policy()
    if current not in (BASELINE.strip(),desired):
        raise p.Refused('installed_policy_drift')
    journal.put('verified',operation='installed_eso_role_and_policy',status='matched_immutable_role')
    return current,desired


def approval_envelope(path):
    """Bind conditional future CCR bytes without recording imaginary consent."""
    try:
        receipt=json.loads(Path(path).read_text())
        if receipt['ccr_id']!=p.CCR or receipt['decision']!='approved' or not receipt['supervisor'] or not receipt['decision_ref']:
            raise p.Refused('runner_approval_invalid')
        if set(receipt['runner_artifacts'])!={SCRIPT,POLICY_FILE,CANDIDATE_FILE}:
            raise p.Refused('runner_approval_artifact_set')
        for rel in (SCRIPT,POLICY_FILE,CANDIDATE_FILE):
            if hashlib.sha256((ROOT/rel).read_bytes()).hexdigest()!=receipt['runner_artifacts'][rel]:
                raise p.Refused('runner_approved_revision_mismatch')
        wrapper=json.loads((ROOT/CANDIDATE_FILE).read_text())
        before=wrapper['source_yaml'].encode()
        after=wrapper['candidate_yaml'].encode()
        if hashlib.sha256(before).hexdigest()!=wrapper['source_sha256'] or hashlib.sha256(after).hexdigest()!=wrapper['candidate_sha256']:
            raise p.Refused('candidate_digest_invalid')
        old=yaml.safe_load(before); new=yaml.safe_load(after)
        if old['id']!=p.CCR or old['status']!='proposed' or old['openbao']['auth']['bound_claims_confirmed'] is not False:
            raise p.Refused('candidate_predecessor_invalid')
        old['status']='approved'; old['openbao']['auth']['bound_claims_confirmed']=True
        if old!=new:
            raise p.Refused('candidate_changes_exceed_scope')
        exact={p.CCR_FILE,p.PLAN_FILE,p.SCRIPT_FILE,POLICY_FILE}
        if set(receipt['approved_artifacts'])!=exact or receipt['approved_artifacts'][p.CCR_FILE]!=wrapper['candidate_sha256']:
            raise p.Refused('candidate_approval_invalid')
        for rel in exact-{p.CCR_FILE}:
            if hashlib.sha256((ROOT/rel).read_bytes()).hexdigest()!=receipt['approved_artifacts'][rel]:
                raise p.Refused('bootstrap_approved_revision_mismatch')
        current=(ROOT/p.CCR_FILE).read_bytes()
        if current not in (before,after):
            raise p.Refused('ccr_source_precondition_failed')
        return before,after,receipt['approved_artifacts'][POLICY_FILE]
    except p.Refused:
        raise
    except Exception:
        raise p.Refused('runner_approval_invalid') from None


def activate_candidate(before,after,journal):
    """Called ONLY after receipt validation and installed claims verification."""
    path=ROOT/p.CCR_FILE
    if path.read_bytes()==after:
        return
    if path.read_bytes()!=before:
        raise p.Refused('ccr_source_precondition_failed')
    journal.put('intent',operation='conditional_ccr_state_transition')
    temporary=None
    try:
        with tempfile.NamedTemporaryFile(dir=path.parent,prefix='.cust81-ccr-',delete=False) as file:
            temporary=Path(file.name)
            file.write(after);file.flush();os.fsync(file.fileno())
        os.chmod(temporary,path.stat().st_mode & 0o777)
        if path.read_bytes()!=before:
            raise p.Refused('ccr_source_precondition_failed')
        os.replace(temporary,path);temporary=None
        directory=os.open(path.parent,os.O_DIRECTORY)
        try: os.fsync(directory)
        finally: os.close(directory)
        if path.read_bytes()!=after:
            raise p.Refused('ccr_transition_unverified')
        journal.put('verified',operation='conditional_ccr_state_transition',status='exact_candidate_installed_after_claim_proof')
    finally:
        if temporary is not None:
            temporary.unlink(missing_ok=True)


def verify_ready(journal,desired):
    current,_=preflight(journal,desired_text=desired)
    if current!=desired:
        raise p.Refused('approved_policy_not_installed')
    journal.put('verified',operation='desired_acl_and_immutable_role',status='matched')


def execute(approval,receipt,journal):
    before,after,approved_policy_sha256=approval_envelope(approval)
    current,_=preflight(journal)
    activate_candidate(before,after,journal)
    p.approval(approval)
    # Capture exact approved bytes once. Later repo-file changes cannot alter
    # the authorized ACL input: Bao receives only this snapshot through stdin.
    policy_snapshot=(ROOT/POLICY_FILE).read_bytes()
    if hashlib.sha256(policy_snapshot).hexdigest()!=approved_policy_sha256:
        raise p.Refused('approved_policy_snapshot_mismatch')
    try:
        desired=policy_snapshot.decode().strip()
    except Exception:
        raise p.Refused('policy_invalid_encoding') from None
    if current!=desired:
        # Recheck immediately before the exact write. OpenBao ACL has no CAS;
        # this is an attended owner operation, never an unattended reconcile.
        if read_policy()!=current:
            raise p.Refused('policy_changed_since_preflight')
        journal.put('intent',operation='exact_eso_policy_update')
        try:
            result=p.Bao.run(['policy','write',POLICY,'-'],stdin=policy_snapshot)
        except p.Refused:
            journal.put('outcome',operation='exact_eso_policy_update',status='ambiguous')
            raise
        journal.put('outcome',operation='exact_eso_policy_update',status='observed' if result.returncode==0 else 'ambiguous')
        if read_policy()!=desired:
            raise p.Refused('policy_update_unverified')
        journal.put('verified',operation='exact_eso_policy_update',status='matched')
    # Verify both immutable role and desired ACL even on the idempotent path.
    verify_ready(journal,desired)
    journal.put('intent',operation='reviewed_forgejo_bootstrap_route')
    try:
        result=subprocess.run([sys.executable,str(ROOT/p.SCRIPT_FILE),'--approval',str(Path(approval).resolve()),'--receipt',str(Path(receipt).resolve())],capture_output=True,check=False,timeout=1000,cwd=ROOT)
    except Exception:
        journal.put('outcome',operation='reviewed_forgejo_bootstrap_route',status='ambiguous')
        raise p.Refused('bootstrap_observation_failed') from None
    # Even whitespace violates quiet owner command. Raw child/network bytes
    # never enter receipts or caller output; failed/ambiguous writes retained.
    if result.returncode!=0 or result.stdout or result.stderr:
        journal.put('outcome',operation='reviewed_forgejo_bootstrap_route',status='stopped_check_child_receipt')
        raise p.Refused('bootstrap_route_unverified')
    journal.put('outcome',operation='reviewed_forgejo_bootstrap_route',status='observed_success')
    verify_ready(journal,desired)
    journal.put('terminal',outcome='policy_and_custody_verified_delivery_pending')


def main(argv=None):
    parser=argparse.ArgumentParser()
    mode=parser.add_mutually_exclusive_group(required=True)
    mode.add_argument('--preflight',action='store_true')
    mode.add_argument('--execute',action='store_true')
    parser.add_argument('--approval')
    parser.add_argument('--receipt',required=True)
    parser.add_argument('--bootstrap-receipt')
    args=parser.parse_args(argv)
    journal=None
    lane_lock=None
    try:
        if args.execute and (not args.approval or not args.bootstrap_receipt or Path(args.receipt).resolve()==Path(args.bootstrap_receipt).resolve()):
            raise p.Refused('execute_inputs_invalid')
        lane_lock=os.open('/tmp/'+p.CCR+'-policy-state-'+str(os.getuid())+'.lock',os.O_RDWR|os.O_CREAT|os.O_NOFOLLOW,0o600)
        if os.fstat(lane_lock).st_uid!=os.getuid() or os.fstat(lane_lock).st_mode & 0o077:
            raise p.Refused('lane_lock_owner_or_permissions')
        p.fcntl.flock(lane_lock,p.fcntl.LOCK_EX|p.fcntl.LOCK_NB)
        journal=p.Journal(args.receipt)
        if args.preflight:
            preflight(journal)
            journal.put('terminal',outcome='read_only_preflight_verified')
        else:
            execute(args.approval,args.bootstrap_receipt,journal)
        return 0
    except Exception as error:
        if journal:
            journal.put('terminal',outcome='stopped_reconcile_before_retry',error_code=str(error) if isinstance(error,p.Refused) else 'internal_failure')
        return 1
    finally:
        if journal:
            journal.close()
        if lane_lock is not None:
            os.close(lane_lock)

if __name__=='__main__':
    try:
        result=main()
    except Exception:
        result=1
    raise SystemExit(result)