b2c2848e49
Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a0726e-5232-73f2-aaca-2c05ceb62efb
69 lines
3.4 KiB
Python
69 lines
3.4 KiB
Python
#!/usr/bin/env python3
|
|
"""User-authorized empty KV seed for CCR-2026-0016; silent OIDC child."""
|
|
import json
|
|
from pathlib import Path
|
|
import subprocess
|
|
import sys
|
|
|
|
DATA_PATH = 'platform/data/workloads/glas-harness/claude-agent-dev'
|
|
META_PATH = 'platform/metadata/workloads/glas-harness/claude-agent-dev'
|
|
RECEIPT = Path('/tmp/glas-anthropic-empty-receipt.json')
|
|
|
|
def bao(*args, payload=None):
|
|
r = subprocess.run(['bao', *args], input=None if payload is None else json.dumps(payload),
|
|
text=True, capture_output=True, timeout=30)
|
|
if r.returncode:
|
|
raise RuntimeError('bao_operation_failed')
|
|
return json.loads(r.stdout) if r.stdout.strip() else {}
|
|
|
|
def main():
|
|
if sys.argv[1:] == ['--verify-custody']:
|
|
result = bao('read', '-format=json', META_PATH)
|
|
observed = result['data']
|
|
version = observed.get('current_version', 0)
|
|
current = observed.get('versions', {}).get(str(version), {})
|
|
if version < 2 or not current or current.get('destroyed') or current.get('deletion_time'):
|
|
raise RuntimeError('no_live_successor_version')
|
|
# Deliberately exclude arbitrary custom metadata and all data values.
|
|
receipt = {'ccr': 'CCR-2026-0016', 'path': META_PATH,
|
|
'current_version': version, 'created_time': current.get('created_time'),
|
|
'live_successor_observed': True, 'secret_value_read': False,
|
|
'provider_authentication_verified': False,
|
|
'request_id': result.get('request_id')}
|
|
Path('/tmp/glas-anthropic-custody-receipt.json').write_text(json.dumps(receipt))
|
|
return
|
|
if sys.argv[1:] == ['--complete-metadata']:
|
|
receipt = json.loads(RECEIPT.read_text())
|
|
if receipt.get('path') != DATA_PATH or receipt.get('version') != 1:
|
|
raise RuntimeError('invalid_receipt')
|
|
observed = bao('read', '-format=json', META_PATH)['data']
|
|
if observed.get('current_version', 0) < 1:
|
|
raise RuntimeError('missing_seed')
|
|
elif not sys.argv[1:]:
|
|
# CAS zero makes concurrent creation and existing versions refuse; no data GET.
|
|
result = bao('write', '-format=json', DATA_PATH, '-',
|
|
payload={'options': {'cas': 0}, 'data': {'ANTHROPIC_API_KEY': ''}})
|
|
version = result['data']['version']
|
|
receipt = {'ccr': 'CCR-2026-0016', 'path': DATA_PATH, 'version': version,
|
|
'empty_seed_created': True, 'metadata_written': False,
|
|
'request_id': result.get('request_id')}
|
|
with RECEIPT.open('x') as f:
|
|
json.dump(receipt, f)
|
|
else:
|
|
raise RuntimeError('invalid_arguments')
|
|
# Only non-secret custom metadata. No secret expiry is enforced by KV metadata.
|
|
bao('write', '-format=json', META_PATH, '-', payload={'custom_metadata': {
|
|
'ccr': 'CCR-2026-0016', 'custody_owner': 'railiance-platform',
|
|
'provider': 'anthropic', 'organization_id': 'e1a8f305-9e64-4639-a7fd-af48e34f37c7',
|
|
'provider_key_name': 'claude_key_bernd.worsch',
|
|
'provider_expires_at': '2027-01-31T21:00:00Z',
|
|
'seed_version': '1', 'seed_contains_secret': 'false',
|
|
'handoff': 'operator creates next version in UI; runtime lane remains inactive'}})
|
|
receipt['metadata_written'] = True
|
|
RECEIPT.write_text(json.dumps(receipt))
|
|
|
|
if __name__ == '__main__':
|
|
try:
|
|
main()
|
|
except Exception:
|
|
sys.exit(1) # contained executor must never return provider/client output
|